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I. 



INTRODUCTION 



Safety is generally recognized as an essential part in 
overall system operation. According to Lawrence (1976) safety 
can be defined as a judgment of the acceptability of risk. 
"Safety is the minimization of injury and loss resulting from 
nondeliberate acts such as accidents and natural calamities" 
(National Safety Council, 1973). 

A function is safe if its risks are judged to be acceptable. 
This definition emphasizes the relativity and judgmental 
nature of the concept of safety. It also implies that two 
very different activities are required for determining how 
safe things are: 

a. Measuring risk, an objective but probabilistic pursuit. 

b. Judging the acceptability of that risk (juding safety) , 
a matter of personal, social and economic value judgment. 

System safety is required to prevent injury and damage 
in system design. Hammer (1972) in his Handbook of System 
and Product Safety suggests that injury or damage can result 
from four fundamental causes or combinations thereof: 

a. material failure. 

b. human error. 

c. adverse characteristics of a product. 

d. unusual environmental conditions. 

Recently, personnel concerned with accident prevention 
have become more convinced that injury or damage from any 
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of those causes can be prevented or lessened through good 
design and planning (Figures 1 and 2) . Figure 1 suggests 
a model of the material failure/malfunction accident. The 
approach to the investigation, analysis, and prevention of 
mishaps caused by material failure/malfunction is FIRE 
(material failure/malfunction, system inadequacy, and remedial 
measure) . They are defined as follows: 

a. A material failure/malfunction (F) is a component or 
system that 1) ceases to operate entirely, 2) operates, 
but not as designed or intended, 3) operates as de- 
signed, however, operational needs require enhanced 
performance. A material failure/malfunction is con- 
sidered for analysis only when it is judged to have 
caused or contributed to the mishap, not resulted 
from the mishap. 

b. A system inadequacy (I) is an element of the aviation 
system that did not operate as intended or designed. 

An I is assigned only when it is judged to have 
caused, allowed, or contributed to the occurrence 

of an F. More than one I may be assigned to a given 
F . 

c. A remedial measure (RE) is an action required to correct 
or at least reduce the operational impact of an I . The 
RE may be directed at any command level for implan- 
tation and is not to be restricted by current tech- 
nology or budgetary, personnel, and equipment resources. 
More than one RE may be recommended for a given I. 

Figure 2 presents a functional model of U.S. Army's Air- 
craft Accident to the pilot error accident among human errors. 
Items 1 through 8 are the basic elements of the aviation sys- 
tem. When one or more of these elements is out of tolerance, 
an overload (Item 9) is placed on the pilot's system role 
(Item 10) in that he must continue to perform his normal tasks 
while correcting or adjusting for the abnormal system condi- 
tion. When this exceeds the pilot's ability to cope with it 
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Figure 1. Model of Mishap Caused by Material Failure/ 
Malfunction (G. Dwight Lindsey and William 
R. Brown [1979] , Appendix F-3) 
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Figure 2. Model of Accident Involving Pilot Error 
(Ricketson, 1974) 

or occurs at a critical time, he makes errors (Item 11) in 
his normal tasks and/or in handling the abnormal condition. 
Most of these errors slip by without causing an accident 
(Item 12) . But, when events or circumstances operate un- 
favorably, the error leads to an accident (Item 13). 

This approach views pilot error accidents as the result 
of the pilot's system role being overloaded by inadequacies 
of the pilot, other systems elements, or both. Accidents 
describe a point in time to look for system inadequacies. 

This model exemplifies an attempt to approach accident causes 
from a "systems" standpoint. Research has indicated that 
human error, unlike hardware difficiency, is rarely the sole 
factor in an accident. The applicability of this functional 
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model is not limited to pilot error accidents. It is a model 
that may be used in any evaluation of a man -machine system. 

The most commonly designated cause of accidents is human 
error. In the past decade, more than 70% of Korean Air Force 
aircraft accidents have been attributed to human error 
(Aircraft Accident Data of Korean Air Force, 1980). In acci- 
dents where material failure is recognized, it is often quite 
possible to continue tearing down the equipment until the pre- 
cise portion that failed is isolated and the cause of the 
failure, whether it be corrosion, stress, faulty load con- 
ceptualization, or other factors, can be determined and rede- 
sign proposed. In case of human error, however, the static 
statement that a human being failed provides no guidance to 
future improvement. The need to reduce human error to its 
basic constituents as a means of obtaining insight into the 
causes of these failures has resulted in various approaches 
to segmenting human behavior for analytical purposes. 

According to Florio and Stafford (.1969) , when the primary 
factor of an accident is attributed to human error the acci- 
dent cause may be classified into five general areas: 

a. Inadequate knowledge. 

b. Insufficient skills. 

c. Environmental hazards. 

d. Improper habits and attitudes. 

e. Unsafe behavior. 

Each of these areas are discussed below: 
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Inadequate knowledge . Knowledge is the foundation for 
understanding and the spring-board for the development of 
desirable attitudes toward safe behavior. Ideally every 
individual should learn and appreciate safety rules. Ade- 
quate knowledge is vital if a person is to avoid hazardous 
situations and react properly in such a situation. Also, 
proper knowledge enables the individual to recognize and 
evaluate dangerous situations (i.e., be aware of tolernace 
limits of the system) . 

Insufficient skill . Attempting to perform tasks beyond 
one's ability level creates high-risk situations; thus skill 
level is an important determinant in accident prevention. 

Skills are affected by many things, such as strength, fatigue, 
attitudes, emotion, alcohol, vision, and others. 

Environmental hazards . It is unrealistic to think that we 
can create a perfectly safe environment. Despite our ina- 
bility to control our environment completely, only a small 
percentage of accidents are strictly attributed to environ- 
mental factors. Good engineering practices with good design 
reduce the environmental problems. 

Improper habits and attitudes . Every worker should thoroughly 
understand the development of attitudes and their possible 
modifications . 

Unsafe behavior . Unsafe behavior is the end result of man's 
failure to develop proper habits, attitudes, and knowledge 
concerning safety. Safe behavior entails responding correctly 
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under all circumstances, and avoiding, when possible, high- 
risk situations. There is no excuse for purposely engaing in 
unsafe behavior. 

Accidents are the result of many proximate and casual fac- 
tors. These factors, or variables, interact to creat unsafe 
acts and unsafe conditions, or both, which can terminate in 
an accident causing injury, death, or property damage. An 
unsafe act or condition alone, or in some combination, if 
occurring at the right time may create an accident. 

It is axiomatic that effective prevention must have a 
focal point of application. This implies that the probable 
cause of future accidents can be predicted. This, in turn, 
implies that the causes of past accidents have been determined. 

The cost of accidents is high. In the past decade from 
1970, the cost of aircraft accidents in the Korean Air Force 
approaches $50 million (not including piloes) [Aircraft 
Accident Data of Korean Air Force, 1980]. As a country that 
has small numbers of aircraft, this represents a tremendous 
cost. In the case of the U.S. Navy /Marines , the total acci- 
dent cost (Figure 3) is greater than the K.A.F. For ulti- 
mate efficiency with maximum operational readiness and minimum 
cost, more detailed accident prevention programs must be 
followed. Accident prevention is best pursued within the 
framework of a systematic program (Figures 4, 5, 6). 

Figure 4 represents a model of the factors that may be 
involved in carrying out a system safety program. Minor 
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Figure 3. U.S. Navy/Marine Average Cost per Major Aircraft Accident 
(24th Annual Meeting of the Human Factors Society, 

Los Angeles, October 1980) 
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Figure 4. Safety Program Model (Hammer; Handbook of System 
and Product Safety, 1972, p. 36) 















Figure 5. An Optimal Level of Safety Performance 

(Industrial Engineering, Jan. 1976, p. 20) 
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Figure 6. Safety Improvement Flow Chart 
(Industrial Engineering, March 
1974, p. 9) 
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differences will exist in actual practice because of the 
different organizational structures. However, the model 
indicates broadly the process that takes place. 

A safety program, regardless of its characteristics or 
goal, does cost money and require time. It is generally 
accepted that as the level of safety performance increases, 
the better will be the chances for reducing hazards, and 
consequently, the frequency as well as severity of accidents. 
Beyond a certain performance level, however, the expected 
reduction in hazards starts to taper off and will not be of 
appreciative magnitude to offset the cost associated with 
high levels of safety activities. This is explained well 
in Figure 5. 

Figure 6 as presented in the overall safety improvement 
effort through the accidents reduction approach, includes the 
following basic steps. 

a. Field data assembly. 

In this step operating data are gathered on the system 
to be analyzed to: acquaint the analyst with system opera- 

ting methods, procedures and equipment? and obtain operating 
data in the form of methods and time data for system operations. 
In addition, accident data are gathered to provide a basis 
for identifying accident problem areas and determining poten- 
tial accident cost savings. 

b. System definition. 

Flow charting . Functional flow charts should be developed 
to define the system. The charts serve as a guide for project 
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members, put them on the same level of thinking, and allow 
standard methods and procedure references that all understand. 

The charts should have a numbering system by function 
to permit coding of accident data. The codes allow quick 
reference to what work function was being performed when an 
accident occurred, and are a means for computerized accident 
information storage and retrieval. 

Accident data . All accident data gathered are defined/ 
coded by work function and hazards or causes assigned to 
accidents . Hazards definition is needed to indicate equip- 
ment and system shortcomings with regard to safety. 

c. Identifying problem areas. 

Once hazards and safe data have been gathered, they 
must then be examined for safety problem areas. The problem 
areas should be defined so that concepts may be readily 
developed . 

d. Concept development. 

Once safety problems have been defined, the next step 
is to develop concepts that will eliminate or protect against 
hazards and, as a result, reduce accidents. 

e. Safety evaluation. 

The effects on safety are determined by using the hazards 
exposure data and estimating the reduction in hazards exposure 
for all functions attributable to a new concept. The hazards 
exposure reduction is an engineering estimate made by com- 
paring current machines/systems with those proposed, and 
noting by work function where hazards exposures have been 
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increased or decreased and by how much. The reduction ex- 
pected in accidents is proportional to the reduction in the 
hazard exposure. 

f. Recommendations. 

The last step is to consider evaluation results for con- 
cepts and alternatives and make a decision for further study, 
or choose the most attractive alternatives for design 
development. 

There are certain fundamental concepts and methods that, 
if properly applied, can increase the probability of success. 
Accident prevention is a composite of many related functions, 
each of which must be given proper weight to assure a balanced 
and productive program. It may be considered a closed-loop 
system (Figure 7) comprising many feedback loops in which 
information is collected by the responsible agency, is appro- 
priately processed, is systematically analyzed, and then is 
disseminated to those in a position to make use of the infor- 
mation. The results of this dissemination are reevaluated in 
the light of future accidents. 

To put safety in its proper perspective, it must be first 
realized that safety and efficiency are products of each 
other. That is, the safe establishment is efficient. With 
this in mind, safety then becomes a management problem and 
not just the concern of the foreman or the supervisor. 

Petersen (1978) suggests five basic principles of a safety 
management program. These are: 
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FIX 



PREACCIDENT PLAN 



RECOMMENDATIONS 

DISSEMINATE 

ANALYZE 




ACCIDENT 

INVESTIGATE 

REPORT 



CLOSED LOOP FEEDBACK SYSTEM 



Figure 7. Organizational Approach to Safety 
(Zeller, 1978) 



a. An unsafe act, an unsafe condition, and an accident 
are all symptoms of failure in the management system. 

b. Certain circumstances are predictive of severity of 
accidents . 

c. Safety should be managed like any other operational 
function . 

d. An effective safety program will provide establishment 
of responsibility and accountability. 

e. The function of safety is to locate and define the 
operational errors that allow accidents to occur. 

This function can be carried out in two ways: 1) by 

asking why accidents happen — searching for their root 
causes — and 2) by asking whether certain known effec- 
tive controls are being utilized. 
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Now comes the problem of safety measurement. W. Tarrants 
(1979) discussed this problem as the problem that has existed 
since the very beginning of organized attempts to control 
accidents and their consequences. In its most elementary 
form, measurement has been defined as "the process of assign- 
ing numerals to objects according to rules" (Stevens, 1951). 

When we apply this definition in the safety field, we are 
quickly confronted with problems concerning what "objects" to 
measure and what "rules" to follow. 

The progress and maturity of a science or technology are 
often judged by whatever success has been achieved in the use 
of measures. Measurement, perhaps more than any other single 
aspect, has been the principle stimulus of progress in all 
professional fields. Measurement is the backbone of any 
scientific approach to problem definition and solution. With- 
out adequate measurement in the safety field we can not des- 
cribe the safety state of our operations or determine whether 
or not our safety programs are really accomplishing anything. 
Sound measurement is an absolute prerequisite for control and 
both are necessary for prediction. 

The present thesis effort will 1) perform a literature 
survey of the techniques to measure safety which are applica- 
ble to measurement of flight safety, 2) emphasize the importance 
of accident data collection for analyzing them, 3) refer to 
K.A.F. accident data currently collected whether they are 
applicable or not to measure flight safety, and finally 
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4) suggest methodology to collect data for applying each 
technique . 
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II . LITERATURE SURVEY 

It has become apparent that there are many problems asso- 
ciated with defining a universal criterion for safety measure- 
ment and assessment. One of the chief concerns with the 
conventional standards is the emphasis on accident data. 

Many now recognize that this is more a reaction to existing 
problems than action toward prevention or control of future 
problems. Although experience can be a valuable teacher, 
accident experience points to needless loss, and too often 
doesn't give sufficient information for prevention. 

Personal values present another problem in safety measure- 
ment and assessment. Safety attitudes are strongly dependent 
on the personal values of workers, line management, and 
corporate management; effective safety measurement techniques 
must be capable of addressing this behavioral aspect. 

Applying statistical methods to the population of events 
related to accidents is another problem area. Predictions 
based on statistical analyses of accident data have been 
described as unreliable due to the combination of variables, 
rare events and small sample sizes. Often, attempts are 
made to by-pass this obstacle by combining nonsimilar events 
into a larger population universe. 

Among the methods used for safety measurement are included 
statistical quality control techniques, system safety analysis 
techniques, critical incident technique, learning curve. 
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frequency and severity rate, safety sampling, double average 
comparison technique. Here the author will describe the 
methods which are applicable to flight safety measurement. 

A. CONTROL CHARTS 

Greenberg (1971) suggests that the techniques of statis- 
tical quality control are ready-made tools for safety analy- 
sis because the safety professional has common problems with 
the quality inspector: both would like to be everywhere 

simultaneously to detect changes; and both have to apply some 
practical, effective approaches to their problems. Control 
charts are used for this purpose. According to Brown (1976), 
a control chart is a visual means by which an analyst judges 
whether a process is in control or not. The measurement 
plotted on the chart are those of any random variable . Hence 
the frequency and severity of accidents, as well as any other 
intermediate indicator of hazards, could be plotted. Judgments 
based upon these plots determine if the process is in control 
with respect to the random variable under consideration. 

Figure 8 shows the typical layout of a control chart. 

The units of the random variable are given on the vertical 
scale, indicating that the height of the plotted point repre- 
sents the value of the random variable for the indicated 
time period. The time scale, given by horizontal line 
shows when the value occurred. 

Measurement of central tendency and spread define the 
expected concentration and range of the variable. Thus, if 
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Unit o! Random Variable 




Time Scale 



Figure 8. Sample Control Chart 

(Brown, D.B. [1976], p. 230) 
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the variable behaves in a nonrandom way, we can conclude that 
an outside influence is affecting the random variable . The 
common way of identifying when this occurs is through the 
use of an upper and a lower control limit. These are generally 
placed at equal distances above and below the mean line. 

The measured values as they are recorded in time are 
plotted as indicated in Figure 8. A point falling above or 
below the control limits, respectively, is indicative of an 
out-of-control situation, and assignable causes are generally 
sought. There are other indications of out-of-control situa- 
tions, also. However, prior to discussing these, the means 
for obtaining the control limits will be given. 

The procedures for setting control limits are essentially 
the same as those for setting the acceptance limits in a test 
of hypothesis. The first step involves the establishment of 
significance level a, that is, the probability of concluding 
that the process is out of control when in fact it is in con- 
trol. If methods of identifying causes are expensive and 
the variable is not critical, a low probability can be tolerated. 
However, if an early indication of lack of control is necessary, 
then a high probability of this error should be specified. 

Once the value of ct is determined, the next question involves 
the definition of control. Quite often the state "out of con- 
trol" occurs in one direction only, that is, upper control 
limit would be required as it would in most cases of pollution 
measurements (Figure 9) . Other monitoring of processes would 
require both an upper and a lower control limit. 
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Figure 9. Sample of a Safety Control Chart Used in 
Statistics Approach to Safety Evaluation 
(Industrial Engineering, Dec. 1975, p. 20) 



In either case, the value of a chosen will represent the 
total area of probability in the out-of-control portion of 
the chart. The upper and lower control limits are obtained 
depending upon the random variable, its distribution, and 
the value of a chosen. 

Brown (1976) suggests in the following example that the 
frequency of accidents of a plant has a normal distribution 
with a mean of 6 and a standard deviation of 1.5. Frequencies 
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for the first 6 months have been 4, 7, 5, 12, 8, and 6. Set 
up a monthly control chart for frequency. Allow for a .05 
probability of calling a point out of control when it is not. 



In this example "out of control" is strictly in terms of 
an upper limit. However, the analyst chooses to set up a 
lower limit to provide possible evidence of a lowering of the 
accident frequency. Thus the .05 probability will be divided, 
.025 above the upper limit and .025 below the lower limit. 

The upper limit becomes 
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6 + 1.96(1.5) 



8.94 



and the lower limit is 
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6 - 1.96 (1.5) 



3.06 
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The control chart is given in Figure 10. The fourth month 
was obviously out of control, and assignable causes should be 
sought. In this example the assumption of normality should 
be tested since it does not hold generally. 




Figure 10. Control Chart for Example Described in 
Text (Brown, 1976, p. 231) 

The construction of the chart is simply a matter of apply- 
ing hypothesis testing on a continuous basis. The primary 
advantage is that continuous visual perception of the random 
variable is maintained. This continuous picture enables the 
analyst to make judgments not otherwise discernible. This 
is not limited to the upper and lower control limits demon- 
strated above. Other factors that the analyst can use as 
indicators of abnormal operational behavior include: 
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a. Several points (four or more) in a row on one side 

of the mean line. The probability of four consecutive points 

4 

on one side is approximately .5 , or .0625. 

b. Identifiable cycles. Here two or three years of history 
may be required to identify a given month or other period 

of time when the operation acts in an irregular manner. 

c. Several points in a row, either monotonically increasing 
or decreasing away from the mean line. The probability of 
this type of trend is difficult to establish. However, since 
these points are all on one side of the mean line, the proba- 
bility will be considerably less than .5 n , where n is the 
number of points exhibiting this characteristic. 

In quality-control situations, 3a control limits are 

generally used, based on the l-in-1000 value of a under the 

normal distribution assumption. The 2a and la lines may also 

be set up, however, to help the analyst identify other out- 

of-control indicators. For example, two points in a row 

outside of 2a limits would have an approximate probability 
2 

of (.025) = .000625, which is about the same as the probability 

of one point outside 3a limits, assuming normality. Although 
control charts for safety applications should not be restricted 
to the a = .001 value, the concept of intermediate lines to 
identify irregularities is a good one. 

B. SYSTEMS SAFETY ANALYSIS 

To understand the systems safety analysis we should first 
have a clear picture of what a system is. Worick (1975) 
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defines a system as an orderly arrangement of components which 
are interrelated and which act and interact to perform some 
task or function in a particular environment. The main points 
to keep in mind are that a system is defined in terms of a 
task or function, and that the components of a system are 
interrelated, that is, each part affects the others. The 
task or function which a system performs may be simple or 
complex. Sometimes it is convenient to break up a complex 
task into simpler tasks and consider subsystems of the larger 
system. Subsystems consist of part of the components of the 
overall system and perform a portion of the overall task 
(Figure 11) . The components of a system can cover a wide 
range including machines, tools, material, environmental fac- 
tors, people, documents (such as operating instructions, 
training manuals, or computer programs), and so on. As part 
of a system, the components usually complement each other 
but it is essential to recognize that a failure or malfunction 
of any component can affect the other components and thus 
degrade the performance of the task. 

The sequential steps required in all system analyses 
(Figure 12) are: 

a. Recognition that a problem exists and that the solution 
may be amenable to systems analysis techniques. 

b. Definition of that problem in an appropriate form, 
including a definition of objectives, requirements, and con- 
straints of times, resources, operational environment, social 
acceptability, etc. 
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Figure 11. Example of System Elements in Aircraft Accidents 
(Kent J. Kogler [1976], p. 7) 
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Figure 12. Systems Development Flow Diagram 
(System Psychology — DeGreene 
[1970] , p. 84) 
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c. Definition of system itselft in terms of its hierarchi- 
cal level, boundaries, interfaces, environments, functions, 
and constituent subsystems and their interactions, usually 
expressed in input/throughput/output terms. This iterative 
process begins with gross approximations and works toward 
minute preciseness, involving test and modification of the 
original concept. The result should be a conceptual model 
amenable to quantitative analysis. 

d. Definition of performance criteria for the system as 

a whole, for the various levels of organization, and for the 
combination of its constituents. 

e. Definition of alternative configurations and their 
evaluation in terms of costs, effectiveness, state of develop- 
ment, environmental constraints, etc. 

f. Presentation of alternatives and tradeoff results 
to the user. A number of choices should be presented in 
order of preference. 

g. Performance of ongoing, iterative engineering and human 
factors analyses during systems development. 

h. Analyses of operational systems to gether basic per- 
formance data. 

The importance of these preliminary steps cannot be over- 
emphasized. As in any research, the analyst himself may 
introduce bias in the form of poor problem formulation, not 
understanding the system, or in not understanding the true 
role of analysis. In some cases, it may not be known until 
the system is complete whether the problem was defined correctly. 
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There are several methods which are used for the systems 
analysis techniques, but the author will describe here the 
fault tree and cost-effective analysis. 

1 . Fault Tree Analysis 

Fault Tree Analysis (FTA) was developed mainly by 
engineers who studied engineering systems in great detail, 
with little or no contribution by mathematicians. A possible 
explanation given by R.E. Barlow (1975), J.B. Fussell (1975) 
and N.D. Singpurwalla (1975) is the fact that the construc- 
tion of the fault tree, a basic step in fault tree analysis, 
requires an intimate knowledge of the manner in which a sys- 
tem is designed and operated. The mathematician's lack of 
familiarity with the operation of systems, and perhaps their 
preoccupation with mathematically well-defined problems, has 
deterred their interest in fault tree analysis. 

Brown (1976) developed Fault Tree and cost/benefit analy- 
sis for choosing optimal safety alternatives. Brown shows 
how negative utility amounts can be assigned to all possible 
head events and the relevant possibilities multiplied by the 
negative utilities. The results, which are expected negative 
utility amounts, are called "measures of criticality". 

Reductions in negative expected utility or criticality 
are considered to be quantitative expressions of benefits or 
effectiveness, and these are then related to costs to find 
the optimal combination of safety alternatives for the deci- 
sion maker's cost-benefit trade-off function. 
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Using Brown's methodology the safety manager should 
first utilize the fault- tree analysis technique as a logical 
approach to identify the areas in a system that are most 
critical to safe operation. 

According to R.E. Barlow (1975) and H.E. Lambert 
(1975), FTA is one of the principle methods of systems safety 
analysis. FTA evolved in the aerospace industry in the early 
1960's. It was the result of a contract between the Air Force 
Ballistics Systems Division and Bell Telephone Laboratories 
for the study of inadvertent launch in the Minuteman ICBM 
(Delong, 1970). After initial work at Bell Telephone Labora- 
tories, development of fault tree continued at the Boeing 
Company, where scientists devoted much effort to develop its 
procedures farther and became its foremost proponents . The 
principle of Boolean algebra (Appendix A) is applied for FTA. 

Rogers (1971) has referred to the following six steps 
that were used in applying the technique to the Minuteman 
Program: 

1. Define the undesired event. 

2. Acquire complete understanding of the system. 

3. Construct the fault tree diagram. 

4. Collect quantitative data. 

5. Evaluate fault tree probability. 

6. Analyze computer results. 

Undesired events requiring FTA are identified either 
by inductive analysis, such as a preliminary hazard analysis. 
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or by intuition. These events are usually undesired system 
states that can occur as a result of subsystem functional 
faults . 

FTA is a detailed deductive analysis that usually 
requires considerable system information. It can be a valua- 
ble design tool. It can identify potential accidents in a 
system design and can help to eliminate costly design changes 
and retrofits. FTA can also be a diagnostic tool. It can 
predict the most likely causes of system failure in the event 
of a system breakdown. 

A major difficulty with quantitative fault tree 
evaluation is the lack of pertinent failure rate data. Even 
in cases where the data are goodk it is not clear that we can 
justify one system environment, data that were obtained in a 
different system environment. Nevertheless, quantitative 
evaluations are particularly valuable for comparing systems 
designs that have similar components. The results are not as 
sensitive to failure rate data as in an absolute determina- 
tion of the system failure probability. 

The goal of fault tree construction is to model the 
system conditions that can result in the undesired event. 

One of the advantages of manual fault tree construction is 
that it forces the analyst to understand the system thoroughly. 
Before the construction of a fault tree can proceed, the 
analyst must acquire a thorough understanding of the system. 

In fact, a system description should be part of the analysis 
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documentation. The analyst must carefully define the un- 
desired event under consideration, called the 'top or head 
event' . 

a. Event Description 

A fault tree is a model that graphically and 
logically represents the various combinations of possible 
events, both fault and normal, occurring in a system that 
leads to the top event. The term, event, denotes a dynamic 
change of state that occurs to a system element. System ele- 
ments include hardware, software, human and environmental 
fac tors . 

b. Event Symbols 

The symbols shown in Figure 13 represent specific 
types of fault and normal events in FTA. The rectangle defines 
an event that is the output of a logic gate and is dependent 
on the type of logic gate and the inputs to the gate . The 
circle defines a basic inherent failure of a system element 
when operated within its design specifications. It is there- 
fore a primary failure, and is also referred to as a generic 
failure. The diamond represents a failure, other than a pri- 
mary failure that is purposely not developed further. The 
switch event represents an event that is expected to occur 
or to never occur because of design and normal conditions, 
such as a phase change in a system. The conditional input 
may be applied to any gate and describes a condition which 
must be present to produce the output. For example, an 
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Figure 13. Event Symbols Used in Fault Tree Analysis 
(Brown, D.B. [1976], p. 158 and Rodgers, 
W.P. [1971] , p. 41) 



42 



order sequence of the inputs to an AND GATE may be described 
as a condition input. The triangles are used as transfer 
symbols. A line from the apex indicates a transfer in, and 
a line from the side shows a transfer out. 

c. Logic Gates 

The fundamental logic gates for fault tree con- 
struction are the OR and the AND gates. The OR gate des- 
cribes a situation where the output event will exist if one 
or more of the input events exist. The END gate describes 
the logical operation that requires the coexistence of all 
input events to produce the output event. the INHIBIT GATE 
describes the relationship between one fault and another. 

The input event causes the output event if the indicated con- 
dition is satisfied. If the condition involves a specific 
failure mode, it is represented by an oval. It is shown in 
a rectangle if the condition described is one that may exist 
anytime during the life of the system. The symbols for the 
logic gates are shown in Figure 14. 

d. Construction Methodology 

The fault tree is so structured that the sequences 
of events that lead to the undesired events are shown below 
the top event and are logically related to the undesired 
event by logical gates. The input events to each logic gate 
that are also outputs of other logic gates at a lower level 
are shown as rectangles. These events are developed further 
until the sequences of events lead to basic causes of interest. 
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Symbols for Logic Gates Used in Fault Tree 
Analysis (Rodgets, W.P. [1971], p. 40) 
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called "basic events". The basic events appear as circles 
and diamonds on the bottom of the fault tree and represent 
the limit of resolution of the fault tree. The structuring 
process is used to develop fault tree flows in a fault tree 
(Figure 15) when a system is examined on a functional basis, 
that is, when failures of system elements are considered. 

At this level, schematics, piping diagrams, process flow 
sheets, etc., are examined for cause and effect types of 
relationships to determine the subsystem and component fault 
states that can contribute to the occurrence of the undesired 
event . 

e. Purpose of Fault Tree Construction 

The fault tree, once constructed, serves as an 
aid in determining the possible causes of an accident. When 
properly used, the fault tree often leads to discovery of 
failure combinations which otherwise might not have been 
recognized as causes of the event being analyzed. The fault 
tree can be used as a visual tool in communicating and supporting 
decisions based on the analysis, such as determining the ade- 
quacy of a system design. The fault tree provides a convenient 
and efficient format helpful for either qualitative or quanti- 
tative evaluation of the fault tree, such as determination 
of the probability of the occurrence of the top event. 

f. Evaluation of the Fault Tree 

An objective of fault tree evaluation is to deter- 
mine if there is an acceptable level of safety in the proposed 
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Levels of Fault Tree Development (Barlow, 
R.E . and Lambert, H.E. [1975], p. 16) 
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will the proposed design suitably mini- 



system design, i.e., 
mize the probability of the occurrence of the top event. 

If the system design is found inadequate, then the design is 
upgraded by first identifying critical events (such as com- 
ponent failures) that significantly contribute to the top 
event. Cost constraints, contractual requirements, and other 
factors limit the design changes that can be made. Therefore, 
trade-off studies are necessary to determine what changes will 
be incorporated to reduce the effect of the critical events. 
When all design changes are made, the fault tree is re- 
evaluated to determine if the revised design provides an 
acceptable level of safety and/or reliability. 

According to Brown (1976) the purpose of developing 
a fault tree and quantifying it is to effectively allocate 
the safety budget. To do this, the various alternative safety 
investments are considered in light of their effect upon the 
fault tree and the resulting head event. A measure of cost/ 
benefit is then determined for use in decision making. Before 
completing the presentation of Brown's methodology some ter- 
minology as given by Brown will be introduced, 
g. Cost 

Cost is defined as the dollar outlay to pay for 
the incorporation of a device, method, procedure and so on 
(henceforth called a countermeasure) into the industrial sys- 
tem for a given unit period of exposure. Thus the cost of 
devices that must be periodically recharged and/or replaced 
is based on average costs for a given unit (e.g., a million 
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man-hours (mmh) exposure period) . Permanent fixtures, such 
as machine guards, can be prorated on the basis of the life 
of the machine. The cost of educational programs can be 
prorated, based upon their frequency. All countermeasures 
must, for comparison purposes, have a common denominator, 
h. Benefit 

Benefit is the negative utility reduction. 

Measure of benefit is the expected negative utility. There 
is a negative utility (or cost in terms of dollars and personal 
well-being) associated with accidents. This negative utility 
depends upon the severity of the accident. 

The expected negative utility of the head event 
if it occurs can now be calculated by the following: 



E = 



N 



i=l 



P . U. 
l l 



where : 

P. = the probability of occurrence of the i 

severity class given that the head event 
occurs , 

N = the number of severity classes, 

U. = the negative utility associated with the 
1 i 1 -* 1 severity class. 



An alternative method for calculating E would be 
more appropriate if the values of negative utility from a 
large number of past occurrences of the head event were 
measured directly. Thus the expected negative utility 
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associated with the head event would be obtained from the 
arithmetic mean of these measurements: 

n 

U. 

1 

n 

Both equations above are equivalent under the 
conditions that there are n severity classes (N = n) and that 
the probability of each severity class is equivalent (P^ = i-) . 
This occurs when each accident is considered as a unique 
situation . 

i. Cost/Benefit 

This term is a vague term used in describing a 
variety of applications. Here it is defined as the dollars 
spent per negative utility reduction. 

j . Criticality 

A system is defined as critical if there is any 
failure that will degrade the system beyond acceptable limits 
and create a safety hazard. An absolute measure of criticality 
associated with the head event can be obtained as 



C = P • E 



where : 



C = the expected negative utility associated with 
the head event in the given time or production 
unit. 

P = the head event probability (in occurrence/mmh) . 

E = the expected negative utility (in dollars/ 
occurrence or workday/occurrence etc.). 
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k. Determination of Head-Event Probability 



The value of P can be obtained assuming that a 
proper unit of time or production has been determined to 
adequately define one trial. 



where : 



= the number of occurrences of the head event 
in the trials given by the chosen time or 
production unit. 

An alternative way to determine P is by using the 
fault tree end branch probabilities. This is necessary if 
the effect of alternative countermeasures is to be determined. 

In the OR situation, any of the events will cause 
the subsequent event to occur and, therefore, assuming inde- 
pendence, the probability of occurrence of the subsequent 
event is given by 



P 



0 



n 

1 - n (1 - q.) 
i=l 1 



where : 

t h. 

q^ = the probability of the i ‘ causal event, 
n = the number of parallel branches. 



In the AND situation, all the events must occur 
for the subsequent event to occur and, therefore, assuming 
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independence, the probability of occurrence of the subsequent 
event is given by 



n 

p A = n q 
A i = l 1 

Through a reiterative process the probability of 
the head event can be determined from a knowledge of the 
probabilities of the branch events. This is the value of P 
which was given in the equation C = PE. A system modifica- 
tion will produce a change in this value of expected negative 
utility, thus providing the measure of benefit. 

Brown (1976) gives various examples to demonstrate 
the entire procedure. 

2 . Example 

Figure 16 is an example fault tree for developing 
the head event "Chip in Eye (Grinding)". This particular fault 
tree is to analyze the specific type of eye injury that might 
be caused by the grinding operation. Those who might have 
this accident fall into two mutually exclusive and all- 
encompassing categories: (1) operators and (2) nonoperators. 

Further, assume that the accident will not occur if adequate 
eye protection is worn. Therefore, the two events shown illus- 
trate the first breakdown. The event "Operator Fails to Wear 
Safety Glasses" has an abbreviated label which, if spelled out 
in detail, would read "Operator Fails to Wear Safety Glasses 
and Is Injured by Chip in Eye." 
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pj.gur'S 16. Fault Ttss Xllusttatsd 
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The AND relationship asks the question: "What must 

happen?" not "What could happen?" Four things must occur in 
order for the nonoperator to be injured in this way. These 
four are listed appropriately under the AND gate. 

The event "Motive to Go into Area" analyzed into the 
specific reasons. This eventis used under OR gate here. 

In Figure 17 the probabilities of occurrence are given 
for the end branch events for any million-man-hour period. 
Suppose that records show that in the past there have been 
10 accidents of this type, of which 7 were First Aid, 2 were 
Temporary Total (man had to leave job) , and one resulted in 
a Permanent Partial (caused permanent eye damage) . An example 
of negativue utility schedule is given in Table I. 

Table I 

An Example of Negative Utility 



Severity Negative 

Classification Severity Utility 



1 


First Aid 


20 


2 


Temporary Total 


345 


3 


Permanent Partial 


2,500 


4 


Permanent Total 
(including fatalities) 


21,000 



* 

The value of negative utility need not be a dollar figure 
if other intangibles, such as social costs, are to be 
considered. For this example, however, First Aid was 
a dollar value per case estimated. All other figures 
are average costs per case given by the National 
Safety Council, 'Accident Facts', 1971. 
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Figure 17 . Fault Tree Illustrated the Probabilities 
Assigned 
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The expected negative utility of this accident is: 

E = .7(20) + .2(345) + .1(2500) = 333 

The probability of the OR gate given last: 

P A = 1 - (1 - 0.05) (1 - .5) (1- .01) = 1 - .8935 

= .1065 

The probability of the AND gate is: 

P A = ( .8) ( .1065) (1) ( .5) = .0426 

The probability of the head event is: 

P = 1 - (1 - .01) (1 - .0426) = 1 - (.99) (.9574) 

= .0522 

This is the probability of occurrence of the head event, in 
any million manhours of exposure. 

The criticality associated with the head event is: 

C = P ♦ E = (.0522) (333) = 17.38 

This example will be pursued a bit further to deter- 
mine how modifications on the fault tree are handled. If 
money is spent to improve the safety of this system, one or 
more of the basic event probabilities in the fault tree should 
be reduced or else the expected severity should be reduced. 

If not, either the expenditure should not be made, or else 
the fault tree is incorrect. A reduction in the basic event 
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probabilities will always reduce the probability of the head 
event, P, and therefore it will also reduce the criticality, 

C, of the event. The amount by which the criticality is 
reduced will provide a measure of benefit for the change that 
was made. Hence a measure of benefit can be estimated for any 
safety investment. 

Consider three proposed countermeasures to reduce the 
probability of the head event "Grinding Chip in Eye" originally 
presented in Figure 16. Assume the three alternatives were 
given as in Table II. 



Table II 

Three Proposed Countermeasures and Associated Cost 



Alternative 


Description 


Prorated 

Cost/mmh 


Effect 


1 


Ensure that opera- 
tor stops opera- 
tion whenever 
anyone enters area 


$25 


Reduce proba- 
bility of 
event G to 
.05 


2 


Move storage 
area away from 
grinding area 


$15 


Reduce proba- 
bility events 
H and I to 
zero 


3 


Both 1 and 2 


$30 


Same effects 
as both 1 
and 2 



Let's calculate the probability of head event, criticality, 
savings, and cost/benefit. 
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Alternative 1 



P = 1 - (1 - 0.01) (1 - (0.8) (.1065) (1.0) (0.05) 

= 1 - 0.9858 = 0.0142 

C = P • E = (0.0142)(333) = 4.73 

Savings = 17.38 - 4.73 = 12.65 

Cost/Benefit = 25/12.65 = 1.98 

Alternative 2 

P = 1- (1 - 0.01) (1 - (0.8) (1 - (1-0) (1-0) (1-0.01) ) (1.0) (0.5) ) 

= 1 - 0.986 = 0.014 

C = (0.014) (333) = 4.66 

Savings = 17.38 - 4.66 = 12.72 

Cost/Benefit = 15/12.72 = 1.18 

Alternative 3 

P = 1 - (1 - 0.01) (1 - (0.8) (1 - (1-0) (1-0) (1-0.01) ) (1.0) (0.05) ) 

= 1 - 0.9896 = 0.0104 

C = (0.0104) (333) = 3.46 

Savings = 17.38 - 3.46 = 13.92 

Cost/Benefit = 30/13.92 = 2.16. 
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Summary for alternatives are shown in Table III. 



Table III 

Three Alternative Cost/Benefit Analyses 



Alternative 


Cost 


Original 

Criticality 


New 

Criticality 


Benefit 


Cost/Benefit 


1 


$25 


17.38 


4.73 


12.65 


1.98 


2 


$15 


17.38 


4.66 


12.72 


1.18 


3 


$30 


17.38 


3.46 


13.92 


2.16 



The best investment is the one with the lowest cost/ 
benefit figure. Alternative 2 is superior to the others in 
terms of cost/benefit. 

C. CRITICAL INCIDENT TECHNIQUE (CIT) 

This technique is widely used as a method of discovering 
and attempting to reduce or control hazardous situations be- 
fore accidents occur. CIT examines previously experienced 
difficulties by interviewing persons involved. It is based 
on collecting information on hazards, near misses, and unsafe 
conditions and practices from operationally experienced per- 
sonnel. It can be used beneficially to investigate man-machine 
relationships in past or existing systems and to use the 
information learned during the development of new systems, or 
for the modification and improvement of those already in 
existence. The technique consists of interviewing personnel 
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regarding involvements in accidents or near accidents; diffi- 
culties, errors, and mistakes in operations; and conditions 
that could cause mishaps. The surveys generally request 
the persons interviewed to include their own experiences and 
also experiences of other personnel whom they have actually 
observed. The person is asked to describe all near misses 
or critical mishaps that he can recall. 

In effect, the CIT accomplishes the same end result as an 
accident investigation: identification through personal in- 

volvement of a hazard that has or could result in injury or 
damage. When the witnesses who observed a mishap or near 
miss, but were not participants, are added to those who were 
involved, an extremely large population is available from which 
information on accident causes can be derived. 

Even isolated incidents reported by the technique can be 
investigated to determine whether corrective action is necessary 
or advantageous. However, when a large number of persons are 
interviewed regarding similar types of equipment or operations, 
similarities begin to appear in reports of hazards and near 
misses. Where these indicate deficiencies, difficulties, or 
other inadequacies, they can be accepted as indicators of 
areas in which improvements are necessary in the design of a 
product or system. 

This technique provides a source of data on errors that 
contribute to critical and catastrophic accidents, and obtains 
information directly from operators, who are less reluctant 
to admit errors in nonaccident situations than in accident 
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situations. The CIT has been used in evaluation of aircraft 
pilot safety and has proven beneficial as a qualitative 
safety technique. 

Fitts and Jones (1947) used this technique very effec- 
tively after World War II when they conducted interviews with 
Air Corps pilots on errors made in operating aircraft controls 
and in reading aircraft instruments. Figure 18 indicates the 
classifications of 460 pilot errors made in operating aircraft 
controls. Over 80 percent of the errors reported can be con- 
sidered as errors of design: design of controls, their 

arrangements, and their locations. 

Fitts and Jones also made numerous recommendations for 
changes that would reduce human error, improve controls, and 
increase system effectiveness. These recommendations, many 
of which were incorporated in later aircraft and in human 
engineering standards, are quoted here to illustrate benefits 
that can be generated by this technique as a method of developing 
accident prevention measures: 

a. More than half of all errors in operating cockpit con- 
trols can be attributed directly or indirectly to lack of 
uniformity in the location and mode of operation of controls. 

b. Substitution errors can be reduced by (a) uniform pattern 
arrangement of controls; (b) shape-coding of control knobs; 

(c) warning lights inside the appropriate feathering button; 
and (d) adequate separation of controls. 

c. Adjustment errors can be reduced by (a) automatic fuel 
flow control; (b) simplified one-step operation of wheels and 
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SUBST I TUTION E RROHS 
d was needed 



confusing one control with another, or failing to identify a control when 



.1 Using the wrong throttle quadrant control (confusing mixture, prop pitch, throttle, etc) 

b Coni using Nap and wheel controls 

c Operating a control for ihe wrong engine (feathering button, ignition, mixture, prop pitch, 
throttle, etc ) 

cl Failing to identify the landing light switch or confusing it with some other control 

e Confusing other controls (alarm bell, bomb-bay door, carburetor heat, cockpit heater, 

droppable gas tanks, emergency bomb release, engine heat, intercooler, oil bypass, oil coller 
parking brake, pitot heat, radio tuning control, salvo switch, trim tab, wobble pump) 

TOTAL 



No of 
Errors 



89 

72 

36 

11 



2 1 

229 



Percent 

Errors 



19 

16 

8 

2 

_5 

50 



ADJUSTMENT ERRORS operating a control too slowly or too rapidly, moving a switch to the wrong 
position ur following the wrong sequence in operating several controls 

a Tm nmg fuel selector switch to the wrong tank 19 4 

b Following wrong sequence in raising or lowering wheels 18 4 

c. Failing to obtain desired flap setting 17 4 

d. Adding power too suddenly without proper change »n trim 9 2 

e Failing to lock or unlock throttles properly 5 1 

f Failing to roll in trim fast enough 4 1 

g. Failing to ad|ust other controls properly 11 2 

TOTAL 83 18 

FORGE T TING E RRORS. failing to check, unlock, or use a control at the proper time 

a. Taking ol 1 with flight controls locked (aileron, elevator, rudder, or all controls locked) 16 4 

b Forgett mg generator or magneto switch 14 3 

c. Forgetting to make proper engine or propeller control adjustments (mixture, prop pitch, etc.) 1 1 

rj Forgetting to lower, lock or check landing gear 7 2 

e Tak mq off with wrong trim settings 6 1 

I Tak my ol f wdhou t r emoving pitot cover 4 1 

g Forgetting to operate other controls (bomb-bay doors, bomb-rocket selector switch, coolant 
shutter, flaps, auxiliary fuel pump, fuel selector, hydraulic selector, lights, PDI switch, pitot 

heat, tail wheel lock ) 25 5 

TOTAL 83 18 



Ht VERBAL ERRORS inuvmg j control 
lesii ed result 



i direction opposite to that necessary to produce , 



,t Making level strd ti mi collection 

h. Making level sed winy Rap ad|ustrnedt 

i. Mak my i evei sed movement ol art engine or propel lor conn ol (mixtuie, prop pitch, etc ) 

d Making level sed movement ol some oihei control 

IOTAL 

\j UNIN I EN l ION AL AO 1 I VA I ION inadvertently uperatiny a control without being aware uf it 

(Biakes, carhuretur heat, cuwl Maps, yeneiatoi . ujniiiun, ignition, inverter, landing year, lights mastei 
switch, pilot heat, iadio supercharger) 

b UNAbLh 10 REACH A CONI ROL accident ur near accident resulting from '’putting heart m cot> 
pit ’ to grasp a contr ol, ur h latnlit y to i each a cui Hr ul at all (Car bur etor heat, fuel selector 
nydi aulic switch, landing geai nose wheel < rank mddersl 



8 

b 

b 

7 

27 



24 



14 



Figure 18. 



Classification of 460 Errors Made by Pilots 
in Operating Aircraft Controls (Hammer, 
1972, p. 189) 
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flaps; (c) easily accessible and continuously operable trim 
controls; and (d) improved throttle locks. 

d. Forgetting errors can be eliminated almost entirely by 
adherence to uniform and "natural" directions of control 
movement . 

e. Unintentional activation of controls can be remedied by 
application of existing anthropometric data on body size 

and use of a maximum reaching distance of 28 inches from the 
shoulder for all controls used during critical procedures. 

The CIT procedure was described by Tarrants as carried 
out at one plant of the Westinghouse Company. The steps may 
be summarized as follows: 

a. A group of employees with previous experience and 
involvement in manufacturing processes and equipment was 
selected. Each person included was listed according to vari- 
ous factors to produce as wide a range of experience as 
possible. Representatives were selected randomly from each 
factor group. 

b. The participants were interviewed and informed of the 
study and its objectives. They were given an opportunity to 
withdraw from participation. 

c. At the end of the interview the participant was given 
a copy of the statement on the study and its objectives and 
a list of typical incidents gathered at other plants. This 
procedure was to stimulate the recall process. 

d. Participants were asked to describe any incidents that 
they could recall, whether or not they had resulted in injury 
or property damage. They were asked whether they recalled 
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any incident similar to those that had occurred at other 
plants, as described on the list they had been provided. 

e. Questioning was carried on until human errors or un- 
safe conditions in any recalled incident could be described. 

The 20 participants related 389 incidents of 117 differ- 
ent types. Over 50 percent more potential accident causes 
were found by this method than had been identified from acci- 
dent records. One participant estimated that almost 70 per- 
cent of the problems reported occurred every day, indicating 
an almost constant exposure to danger. Once a potential 
accident has been reported, the hazards are corrected so that 
a real accident will not occur. As these hazards are eliminated 
or reduced so should accident frequency and severity rates. 

The major deficiency of this method is that its effective- 
ness will be dependent upon all employees reporting those 
potential accidents (incidents) in which they are involved. 
Usually employees will be reluctant to do so. They are worried 
about their supervisors attitude, their own personal records 
and/or spoiling the company's safety record. Thus data with 
some degree of bias are introduced. 



63 



III. STATEMENT OF PROBLEM 



Through the literature survey, several methods among the 
existing safety measurement techniques have been discussed 
for measurement of flight safety. From the above discussion 
it is apparent that the measurement of flight safety is an 
area for research and development which will allow major 
improvement in overall flight safety programs. 

A most important aspect in the development of an effective 
safety program is collection and evaluation of data. The 
primary goal of any safety program is to prevent accidents. 
Accident prevention is best pursued within the framework of 
a systematic program. Detailed and well-selected collection 
of factual data is the first step in the development of an 
effective safety effort. By means of an overall evaluation 
of safety by analysis and dissemination of this data, acci- 
dents can be predicted and prevented. 

The Korean Air Force is currently collecting data on air- 
craft accidents. Data categories collected are as follows. 

a. Accident rate and flight time per model and year 

b. Total accident rate, pilot and aircraft loss per year 

c. Accidents by general factors (pilot, maintenance, 
material, supervisor, etc.) 

d. Accidents in detail per factors (e.g., pilot factor: 
spin, disorientation, unusual, air collision, etc.) 
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e. Major accidents per flight time (e.g., 400 ~ 500 hrs: 8, 
900 ~ 1000 hrs: 4 , 1700 - 1800 hrs: 1, etc.) 

f. Major accidents per flight phases (take off, climb, 
in flight, Let Down, landing) 

g. Major accidents per missions (Air to Air, Air to Ground, 
Instrument Flying, etc.) 

h. Major accidents per rank 

i. Aircraft accident cost. 

Many of the data categories listed above are useful and 
lend themselves to analysis (Items a, b, e) . There are, how- 
ever, some major deficiencies in data being collected by the 
Korean Air Force. From the accident prevention viewpoint 
and for the analysis of pilot error, it would be better to 
categorize the pilot errors of item c as follows: 

a. Design-induced pilot factor (e.g., instruments that 
can not be seen properly because of their location) . 

b. Operations-induced pilot factor (e.g., air traffic 
control terminology) . 

c. Environment-influenced pilot factor (e.g., weather 
phenomena such as fog or thunderstorms) . 

d. Innate pilot factor (e.g., poor technique, misuse of 
controls, medical and psychological conditions). 

Specifically, the data of items g and h are inadequate. 

For example, item g must include flight time or sorties. That 
is, accident rate must be calculated for each mission. Item 
h must consider the total flight time and pilots of each rank. 
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For example, suppose the cumulative number of pilots, flight 
time, and accidents for 10 years are shown in Table IV. 



Table IV 

Example Data for Ranks by Pilots, Flight Time and Accidents 



Rank 


2nd Lt. 


1st Lt. 


Capt . 


Maj . 


Lt. Col. 


pilots 


400 


1,000 


1,500 


800 


300 


flight 

time 


40,000 


150,000 


450,000 


160,000 


30,000 


acci- 

dents 


3 


18 


19 


9 


9 



Then, 



Accident rate 



(Number of pilots in each rank/total pilots) 

x Accidents 100,000 

Flight time of each rank 



Total pilots = 400 + 1,000 + 1,500 + 800 + 300 = 4,000 

Accident rate of _ (400/4000) * 3 x 100,000 _ 71 - 

2nd Lt. “ 40,000 



By the same formula, accident rates of 1st Lt., Capt., Maj . , 
and Lt. Col., are 3.0, 1.58, 1.13, and 2.25. 

From the data collected above we can only use control 
chart techniques because the data was not collected in detail. 
But the problem is that it is difficult to evaluate the over- 
all safety effectiveness by this method because the control 
chart uses only the frequency or severity of accidents vs. 
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time (year, month, or week) . Accidents must be considered 
as multiple causation events, i.e., rarely is a single 
factor solely responsible for the event. 

The present thesis effort has been designed to examine 
data currently collected by the K.A.F. and make recommendations 
which will improve data collection procedures and subsequent 
analysis . 
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IV. APPROACH TO MEASUREMENT OF FLIGHT SAFETY 



Several measurement techniques applicable to flight 
safety were presented in the literature survey. The problem 
is how should the data be collected to efficiently apply such 
measurement techniques? The author will present several 
methodologies to collect and apply data. 

A. CONTROL CHARTS 

The primary objective of this method is to show compari- 
sons among accidents which occurred in a given period and to 
visually indicate out of control situations by plotting fre- 
quency of accidents vs. time (year, month, or week) and upper/ 
lower control limits. A point falling above or below the con- 
trol limits, respectively, is indicative of an out-of-control 
situation, and assignable causes are generally sought. To 
measure flight safety, we actually need only the upper control 
limit . 

It is easy to collect these data. The K.A.F. does, in 
fact, collect monthly and yearly aircraft accident data. In 
addition, it may be advantageous to add daily and weekly 
data to monthly and yearly statistics. 

Examp le 

1. Data for accident rate (major, minor, or major + minor) 
per week (given period) . 

2. Pilot loss rate per year, month. 
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If the above data was collected, it would be possible to 
determine trends of accidents on a daily basis. In particu- 
lar, we could analyze the accident factors (pilot error, 
material failure, supervisor, maintenance, environment) from 
item i by observing the upper control limit zone. 

Analysis of Existing Data 

The aircraft accident rate of the K.A.F. is as in Table V. 

Table V 

K.A.F. Accident Rate by Year 



Year 


70 


71 


72 


73 


74 


75 


76 


77 


78 


79 


Acci- 

dent 

rate 


10.8 


7.6 


7.3 


9.7 


9.5 


5.7 


o 

• 

LO 


• 

• — I 


5.6 


CM 

• 



Then the control chart of this data is shown in Figure 19. 




U.L. 



x 



Ii . L . 



Year 
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From the above data 



x 



n x . 




66.8 

10 



6.68 



S = >/ [£xj - (^x i ) 2 /n]/n-l = 2.87 



The t distribution is used. For a = 0.05, 



U.L. 



x + t — = 6.68 + t _ 

n-1,1-^- /n 9 " 975 /TO 



6.68 + 2.262 x 1^11 = 8.73 

/10 



L.L. = x - t 



n-l,l-j /n 



— = 6.68 - 2.262 x 



2.87 

/To 



= 4.63 



The accidents of 70, 73, and 74 are out of the control 
limit. So we have to analyze the accident causes of these 
years to prevent or reduce accidents in the future. Also we 
have to prepare accident prevention program according to the 
outcome of analysis. 

Let's take a = .01. 



U.L. = x + t 



n-l,l-| /n 



= 6.68 + t 



9, .995 



2.87 

/To 



= 6.68 + 3.25 x 



2.87 

/TT 



= 9.63 



70 



L.L 



x - t 




S 



6.68 - 3. 25 x h. 1Z 
/10 



3.73 



The accidents of 70 and 73 year are yet out of control 
limit. The control chart is almost the same as test of 
hypothesis . 



The acceptance and rejection regions are illustrated in 
Figure 20. Here assume that the hypothesis is true and 
use the value of a to determine the "cut-off" point for 
acceptance or rejection. a is the probability of rejection 
given that the hypothesis H Q is true. 



Figure 20. Acceptance and Rejection Region 



For Hq : y = y Q and : y > y Q , assuming that H Q is 

true, the distribution is centered at y^. Now according to 






U.L 



Accept 



Reject 
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the definition of a we will accept a probability of rejecting 



Hq even though it is true. 

Example 

Aircraft accident rate of the K.A.F. was supposed to be 
reduced up to average 5.0 from 1970 to 1979. Was the acci- 
dent level reduced significantly? 

Hq : y = y Q (Accident level was reduced significantly) 

H^: y > y^ (Accident level was not reduced 
significantly) 

Then from accident data given above : 



U.L. 



p 0 + Vl.l-ot ' ^ 

5.0 + t. . • Sill. (0 = 0.05) 

y ' 0 * y b /To 

5.0 + 1.833 • hll = 6.66 
/10 



We know x = 6.68. Thus x > U.L. This means Hq is rejected 
and H^ : y > y^ is accepted. Therefore we can conclude that 

the K.A.F. has not yet reduced the aircraft accident success- 
fully within given period. If a increases, the value of the 
U.L. decreases and the probability of acceptance Hq decreases 
more . 



B. FAULT TREE ANALYSIS (FTA) 

Fault tree analysis can be used to improve flight safety 
through the identification of safety critical items and make 
cost effective recommendations for their improvement. The 
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identification of failures which impact the safety of a com- 
plex mechanical system of aircraft requires a disciplined 
formal methodology capable of addressing the causes of failure 
and failure interactions at low levels of complexity which 
influence the entire system. FTA can provide such a disci- 
plined methodology and also be applied to quantitatively 
identify critical modes of failure (both hardware and human) 
whose occurrence could cause a hazard in flight. The appli- 
cation of FTA initially requires the definition of a system 
and once the system is defined the basic events are identi- 
fied by starting with the accident and looking for its cause 
at a lower level of complexity. By repetition of this cause 
and effect relationship, the most elementary cause is finally 
deduced. The interconnections of the causal events with logic 
symbols form the branches of the fault tree . The quantita- 
tive evaluation of the probability of system failure requires 
the collection of failure rate data from which basic proba- 
bilities are determined. These basic event probabilities 
are combined using rules of Boolean algebra to determine 
criticality of each basic event. Based on relative criti- 
calities, cost effectiveness techniques can be used to decrease 
probabilities of basic hazards. 

A fault tree is a failure analysis technique which analyzes 
system failures beginning at the highest level of complexity 
and ending at the lowest level of complexity. The upper most 
event is identified as an accident which may have several 
degrees of severity. The degree of severity is not identified 
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on the fault tree diagram but is accounted for in the cost 
effectiveness calculation. The tree construction is a logi- 
cal process producing a graphical display of events such 
that all possible causes of a particular failure are shown 
below that failure. Subsystem failures are further subdivided 
and depicted in greater detail until the bottom of the tree 
is reached. The tree is structured to systematically show 
contributory events and failures and their relationship to 
each other and to the accident. Each component of the sub- 
system capable of producing an event is examined and how its 
failure would contribute to a mishap determined. 

According to Hammer (1972) , in the application of the 
fault tree methodology the following assumptions are generally 
made, concerning the characteristics of components, condi- 
tions, actions and events: 

a. Components, subsystems and similar items can have only 
two conditional modes; they can either operate successfully 
or fail. No operation is partially successful. 

b. Basic failures are independent of each other. 

c. Each item has a constant failure rate that conforms 
to an exponential distribution. 

The benefit of the generalized fault tree structure is 
realized through the general applicability of the improvement 
recommendations, derived from the fault tree analysis. 

The author will draw a fault tree diagram based on the 
K.A.F. aircraft accident data. The primary factors of K.A.F. 
aircraft accidents in the 1970 's were classified into six 
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categories, i.e., pilot, maintenance, material, supervisory, 
environmental, and unknown factor. Fault tree must include 
detailed fault factors from top structure to subsystem, but 
K.A.F. data has not been collected in sufficient detail to 
evaluate the most effective use of FTA. For example, material 
factors of K.A.F. are shown in Table VI. What was the basic 
event of flight control in Table VI? Was it pitch, yaw, or 
roll failure? If the failure was due to yaw, what was the 
basic event of yaw? Was it caused by wear, shock, or vibra- 
tion? The fuel system can be included as a subsystem of 
thrust control and also must be divided into subsystems. 

Data presented in Table VI is inadequate for applying FTA. 

Among the primary factors of K.A.F. data pilot, main- 
tenance, supervisory, and environmental factors are human 
error. Fault tree diagram of K.A.F. accident data is shown 
in Appendix B. More subsystems and basic events were added 
to illustrate a sample aircraft accident fault tree and develop 
the methodology for collecting and applying data. A method 
to collect data will be described below. 

1 . Data Collection 

For FTA, the data is not confined only to major and 
minor accidents. Incident and Forced/Precautionary Landing 
data are also included, i.e., accidents are sorted into cate- 
gories such as : 

a. Major accident 

b. Minor accident 
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Table VI 



Material Factors by Year of Accident (Major & Minor) 



^<Year 

Item 


70 


71 


72 


73 


74 


75 


76 


77 


78 


79 


Total 


Flight Control 








1 














1 


Fuel Systan 


1 




1 






1 


1 


1 




2 


7 


Turbine Sect. 








1 














1 


Compressor 

Section 




1 








1 


2 








4 


Ignition 

System 


1 




















1 


Oil System 








1 














1 


Elec. System 




1 


















1 


landing Gear 








2 






1 








3 


Engine 


















1 




1 


Propeller 

Unit 














1 








1 


Piston Pod 




1 


















1 


Flare Misfire 








1 














1 


Flame Out 








1 














1 


Fire 




1 








1 


1 








3 


Total 


2 


4 


1 


7 




3 


6 


1 


1 


2 


27 
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c. Incident. 



d. Forced/precautionary Landing. 

Basic events which will be contributed to accidents 
in these subcategories are: 

a. Supervisory factors. 

b. Psychophysiological factors. 

c. Environmental factors. 

d. Material failure. 

e. Maintenance. 

Sample format of supervisory factors is shown in 
Table VII. More detailed data to be collected is presented 
in Section V. 

2 . Development of an Equation for Corrective Action 

Recommendations 

This section concentrates on the development of an 
equation by which to evaluate cost effectiveness in terms of 
parameters derived from the fault tree analysis and parameters 
which may be readily estimated from the data. 

The cost effectiveness index provides a measure of 
dollars saved per dollar spent in implementing recommenda- 
tions. It is based on the projected percentage improvement 
in criticality if the improvement recommendation is implemented. 
The cost effectiveness index is the ratio of cost savings to 
improvement cost. 



CE = 




Cl) 



where : 
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Example Supervisory Factor Reporting Format 
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CE 


= cost effectiveness index 


c s 


= cost savings 


C I 


= improvement cost 



The cost savings may be expressed in terms of the 
difference in total accident cost achieved by implementing 
the improvement recommendation. This may be expressed as: 

C S “ N(C A - C AI> (2) 



where : 




c s 


= cost savings 


N 


= number of accidents 


C A 


= cost of accident without improvement 


C AI 


= cost of accident with improvement 



The general cost of a single accident may be expressed as: 



C A 


= (CR) (C H ) l a i y ± O) 

i 


where : 





CR = criticality 



C H 


= cost of a total lost 


a . 
i 


= probability of an accident being of severity i 


Y i 


= relative cost of an accident of severity i 


i 


= 1 - major incident 
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i = 2 - minor accident 

i = 3 - incident 

i = 4 - forced/precaution landing 

This equation may be rationalized in terras of the 
criticality representing the probability of an accident of 
any severity occurring due to a given basic fault. The 
probability of the accident being of severity i is then 
(CR) (a . ) . The cost of an accident of severity i is (C„)(y.). 
The cost likely to be incurred due to accidents of all 
severities is the sum of the products of these terms as 
expressed in the equation above . 

The criticality after implementation of the improve- 
ment recommendation may be expressed as : 

CR' = (1-3) (CR) (4) 



where : 



3 = percent improvement in criticality 

The cost of an accident after implementation of the 
improvement recommendation may then be expressed as: 

C AI = (1-3) (CR) (C ) l a iYi (5) 

i 

By substituting equations (3) and (5) into equation 
(2) , an expression for cost savings is obtained in terms of 
parameters which have known numerical values. 
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Thus 



C S = N(C A - C AI } 

= N{ (CR) (C H )[a i y i - (1-6) (CR) (C H ) £ 0 ^} 
= N(CR) (C H ) {1 - (1-6) }Ja i Y i 



C s = N6 (CR) (C R ) I a i Y i 



( 6 ) 



An expression for the cost effectiveness ratio is 
obtained by substituting equation (6) into equation (1). 



CE 




N6 (CR) (C R ) 



• Y • 

A 1 1 



Thus 



CE = N6 (CR) ^ l a . y . 

i 



(7) 



In order to apply this formula we have to set up a 
general criteria for each item, 
a. Criticality (CR) 

The author uses the definition of CR suggested 
by Birnbaum (1975) . Let g be a function that computes the 
probability of the top event in terms of the basic event 
probabilities. To generate this function we need a Boolean 
expression for the top event in terms of the Boolean variables 
of the basic event. The outcome of each basic event at time 
t has an indicator variable Y. (t) , 

l 
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1 when basic event i has occurred at time t 

Y ± (t) = 

0 otherwise 

If the state of each basic event is random, the 

probability that event i occurs by time t can be defined to 

be F^(t). If A^(t)dt is defined to be the probability that 

event i occurs between t and t+dt, given that event i has 

not occurred by time t, then F^(t) can be expressed in terms 

of A. (t) : 

1 

t 

- / A. ( t) dt 
F i (t) = 1 - e 0 

A^ (t) is commonly referred to as the hazard or failure rate 
at time t. 

If we construct a fault tree where the top event 
is system failure and the basic events are component failures, 
then Birnbaum's definition of component importance becomes 

3g{F(t) } 

-p — ( t7~ = g{i i /F(t) } -g(O i ,F (t) } 

where g{F (t) } is the probability that the top event occurs 
by time t. The above expression is the probability that the 
system is in a state in which the functioning of component 
i is critical: the system functions when i functions, the 

system fails when i fails. The probability that the system 
is in a state at time t in which component i is critical and 
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that component i has failed by time t is the criticality of 



the ith basic event, i.e.. 



CR = [g{l i ,F(t)} - g{O i ,F (t) }]F i (t) . 



Example 

Assume that the fighter aircraft accident data 
(including incident and forced/precaution landing) of the 
K.A.F. was collected for a 10 year period and a fault tree 
diagram was constructed the same as in Appendix B. From 
this diagram, the number of basic event accidents due to 
insufficient experience is 3. What is the basic event 
failure probability, head event probability and basic event 
criticality? 

Before solving this problem, assume the following 
data was collected. 

Total flight time of 

fighter aircraft 606,100 hr 

Total sorties 586,600 

Average flight time 1.033 hr 

Assuming an exponential failure distribution, the failure 
rate is: 



X ■ 6067100 - 4 - 95 * 10 "> r 

Probability of basic event 'limited experience' is: 
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F x (t) 



1 - e Xt = Xt = 4.95 x 10 6 x 1.033 

5.11 x io -6 



For basic event ' inadequate training ' , 



A - 606^100 - 3.30 xl0- 6 /hr 

F 2 (t) = Xt = 3 .30 x io" 6 x i. 033 

= 3.41 10 -6 



Then, the probability of flight beyond capability is 

2 

P = 1 - n (1 - F ) 

x i=l 1 

= 1 - (1 - 5.1 x 10 -6 ) (1 - 3.41 x 10~ 6 ) 

= 8 .52 x io -6 



In the same way , 

P^ = Probability of faulty flight plan 
= 5.10 x io -6 

P ^2 = Probability of inadequate analysis 

= 3.40 x io~ 6 

P^^ = Probability of poor crew coordination 

= 5.10 x io -6 
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P^ = Probability of inadequate briefing 
= 5.11 x lo -6 

P 21 = Probability of supervisory error 

5 

= i - n (1 - p ) 

i=l 

= 1 - (1 - 5.10 x 10" 6 ) (1 - 3.40 x 10 -6 ) (1 - 5.10 x 10 -6 ) 

• (1 - 8.52 x lo” 6 ) (1 -5.11 xio' 6 ) 

= 2.72 x 10 -5 

If we collected all of the other event data and 
the probabilities of each event calculated as in Table VIII, 
then, by using the procedure with AND or OR gate, we have: 



Table VIII 
Failure Probability 



EVENTS 


Failure Probability 


Maintenance 


10.10 x io" 5 


Environmental Condition 


1.03 x io" 5 


Psychophysiological 

Disturbance 


2.05 x IO -5 


Flight Control 


9 .25 x 10 -5 


Thrust Control 


8 .55 x IO -5 


Landing Gear 


6.18 x 10~ 5 


Unknown Crash 


1.20 x 10 -5 



85 



Probability of pilot error = 5.80 x 10 



Probability of human error = 6.81 x 10 



-5 



-5 



-4 



Probability of material failure = 2.40 x 10 



Probability of head event failure = 3.20 x 10 



-4 



Calculation of criticality: 

If the ith component 'Insufficient Experience 1 

failed , 



g{l.,F(t) } = 3.20 x 10 



-4 



If the ith component 'Insufficient Experience' 
didn't fail and the head event failure occurred, then 



F 1 (t) = At = 0 x 1.033 = 0 



Thus 



15 



i - n (i -f. ) 
i=l 1 



= 1 - ( 1 - 0 ) (1 - 3.41 x 10 -6 ) 



= 3.41 x 10 



-6 



21 



1 - (1 - 5.10 x 10 -6 ) (1 - 3.40 x 10 6 ) (1 - 5 . 11 x 10 6 ) 



• (1 -5.10 x 10~ 6 ) (1 - 3.41 x 10 6 ) 



= 2. 21 x 10 



-5 



Finally we get the probability of head event failure as 



3.15 x 10 



-4 



Thus , 
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CR = ( 3.20 x 10 -4 - 3.15 x lo' 4 ) (5.11 x 10 6 ) 

= 2.56 x 10 -11 

b. Number of Accidents (N) 

An estimate of the number of accidents in the 

remaining service life of fighter aircraft in the K.A.F. 

would be calculated if we knew the average sorties flown per 

year and the projected remaining life of operation. Suppose 

the average sorties flown per year was 58660 and the average 

operational life of fighter type aircraft was 8 years. 

From the fault tree it was determined that the 

probability of an accident of any type of basic event is 
-4 

3.20 x 10 . Then the number of accidents expected to occur 

in the remaining operational life is: 

N = (58660) (8) (3.20 x 10 -4 ) = 150 

Though the above value was derived by estimate, its absolute 
value is unimportant since ranking of cost effective proce- 
dures id based on a relative figure of merit. 

c. Percent Improvement in Criticality (8). 

The percent improvement achievable by implementing 
suggested improvement recommendations for the particular fault 
is based on an engineering judgment. 

C H 

d. Ratio of Total Loss to Improvement Cost (^— ) 

I 

Total loss is equivalent to the average acquisi- 
tion cost of all types of fighter aircraft. For each 
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improvement technique, estimates can be made of the cost to 
implement the improvement as a fraction of the acquisition 
cost, Cj/Cg. 

e. Relative Cost of an Accident of Severity i (y^) 

The relative cost associated with a given accident 
depends on its severity. Accident costs will be normalized 
with respect to the average of the manhours required to com- 
plete repair or replacement of major damage for all kinds 
of fighter aircraft. 

Suppose we know the following data. 

1. Major Damage Classification 



Type of aircraft 


F-K 


F-M 


F-X 


F-Y 


F-Z 


Manhours 


500 


600 


700 


800 


900 



2. Minor Damage Classification 



Type of aircraft 


F-K 


F-M 


F-X 


F-Y 


F-Z 


Manhours 


200 


180 


150 


120 


50 



Then the average of the manhours required to complete repair 
or replacement of major damage for all types of aircraft is: 

(500 + 600 + 700 + 800 + 911)/5 = 700 

The average manhours of minor damage is 140. The relative 
cost of a minor accident is then 140/700 = .2. The same ratio 
can be applied in relating an incident to a minor accident 
and a forced/precaution landing to an incident. Assume the 
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relative cost of incident is 0.03 and forced/precaution landing 
is 0.004 for calculation of COST effectiveness as an example. 

f. Probability of an Accident Being of Severity i (a^) 
It is often the case that basic events have 
different probabilities of inducing accidents of varying 
severity, i.e., some event will always result in a major 
accident, whereas other events may induce a major accident, 
minor accident, incident, or forced landing. The probabili- 
ties depend on other interacting elements in the system. 
Therefore, in arriving at a cost effectiveness index, the 
criticality of a basic fault must be weighed to reflect its 
impact on accident severity. This is achieved by introducing 
a factor cu into the expression for cost savings to account 
for the probability of a given accident severity. The evalua- 
tion of this parameter requires an engineering judgment to 
be made of the probabilities of a basic fault causing acci- 
dents of varying severities. 

Sample calculation of CE 

Assume that the accident occurred from limited 
experience (Basic event 1.8 of Appendix B) . The cause of 
failure was due to "order to pilot beyond capability on 
flight". The corrective action recommended is an establish- 
ment of experience criteria. The cost effectiveness of this 
recommendation is: 

From collected data and engineering judgment, 
assume we have 8 = 70%, = 10%, = 40%, = 40%, = 10% 

and C /C = 0.1. Then 

ri 



89 



CE 



C H r 

= N (CR) (=£-) l a . y . 

i = l 1 1 

= 150 x 0,7 x (2.56 x 10 _11 ) x J±— x (0.1 x 1.0 

U • J- 

+ 0.4 x0. 2 + 0.4 x0. 03 + 0.1x0. 000 4) 

= 5 .17 x 10 -9 

The relative cost effectiveness is obtained by 
proportion of the above value to the most cost effective 
item in the list, i.e., set the most cost effective item to 
be 1.0. For example, suppose supervisory error in maintenance 
has the greatest CE value of 65, then relative cost effec- 
tiveness of 3.5 in Appendix B is 1 and accident due to limited 

-7 -11 

experience is 5.17 x 10 /65 = 7.9 x 10 . Example cost effec- 

tiveness ranking is shown in Table IX. We can decide the 
basic event fault is not critical and then it will be eliminated 
from Table IX (e.g., if CR < 10 ^). 

FTA was suggested as a method of system safety 
analysis which can improve flight safety through identifica- 
tion of safety critical items and make cost effective recom- 
mendations. FTA is a detailed deductive analysis that usually 
requires considerable system information. It can be a valua- 
ble design tool. FTA can also be a diagnostic tool in that 
it can predict the most likely causes of system failure in 
the event of system breakdown. 



90 



Sample Cost Effectiveness Ranking 
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C. CRITICAL INCIDENT TECHNIQUE (CIT) 

The CIT consists of a set of procedures for collecting 
direct observations of human behavior in such a way as to 
facilitate their potential usefulness in solving practical 
problems. As a measure for accident research, it reveals 
causal factors in terms of human errors and unsafe conditions 
that lead to aircraft accidents and it provides more infor- 
mation about accident causes and a more sensitive measure of 
total accident performance than other available methods of 
accident study. 

The CIT has been used to collect both accident and near 
accident data without any discrimination being made between 
the two types of data. However, in particular cases the 
investigator may confine his attention to one or the other 
type of data. 

By collection and categorization of common errors from 
human factors data in aircraft operation, possible direction 
of accident prevention and recommendation will be provided. 
For example, if we collect data of specific experiences from 
pilots in taking-off, flying an instrument, landings, using 
controls and using instruments, then the data may provide 
many factual incidents that can be used as a basis for 
planning research on the design of instruments, controls, 
training, and the arrangement of these within the cockpit. 

To be useful the incidents must be detailed enough a) to 
allow the investigator to make inferences and predictions 
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about the behavior of the person involved and b) to leave 
little doubt about the consequences of the behavior and the 
effects of the incident. 

The two primary steps included in the critical incident 
procedure are : 

1 . Collection of the Data 

The most important item for accident research is the 
real data in detail. The CIT is frequently used to collect 
data on observations previously made. This is usually satis- 
factory when the incidents reported are fairly recent and the 
observers were motivated to make detailed observations and 
evaluations at the time the incident occurred. 

The practical problem in collecting the data for des- 
cribing an activity refers to the problem of how it should 
be obtained from the observers. This applies especially to 
the problem of collecting recalled data in the form of 
critical incidents. Three procedures for collecting data 
are described below. 

a. Interviews 

The use of trained personnel to explain to observers 
precisely what data are desired and to record the incidents, 
making sure that all necessary details are supplied, is 
probably the most satisfactory data collection procedure. 

This type of interview is somewhat different from the other 
types of interview and a brief summary of the principle mis- 
hap factors involved will be given. 
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b. Questionnaires 

If the group becomes large, a questionnaire pro- 
cedure is convenient. 

c. Record Forms 

One other procedure for collecting data is by 
means of written records. There are two varieties of recording 
one is to record details of incidents as they happen. This 
situation is very similar to that described in connection with 
obtaining incidents by interviews above. 

A variation of this procedure is to record such 
incidents on forms which describe most of the possible types 
of incidents by placing a check or tally in the appropriate 
place . 

As additional information becomes available on 
the nature of the components which make up activities, obser- 
vers may thus collect data more efficiently by using forms 
for recording and classifying observations. 

2 . Analyzing the Data 

The collected data of a large sample of incidents 
provides a functional description of the activity in terms 
of specific behaviors. The purpose of the data analysis stage 
is to summarize and describe the data in an efficient manner 
so that it can be used effectively. 

For analyzing the data we have to consider two pri- 
mary problems involved. These problems will be discussed 
below . 
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a. Frame of Reference 



There are countless ways in which a given set 
of incidents can be classified. In selecting the general 
nature of the classification, the principle consideration 
should usually be that of the uses to be made of the data. 

The preferred categories will be those believed to be most 
valuable in using the statement of requirements. Other con- 
siderations are ease and accuracy of classifying the data, 
b. Category Formulation 

The induction of categories from the basic data 
in the form of incidents is a task requiring insight, experi- 
ence, and judgment. The usual procedure is to sort a rela- 
tively small sample of incidents into piles that are related 
to the frame of reference selected. After these tentative 
categories have been established, brief definitions of them 
are made, and additional incidents are classified into them. 
During this process, needs for redefinition and for the 
development of new categories are noted. The tentative cate- 
gories are modified as indicated and the process continued 
until the incidents have been classified. The larger cate- 
gories are subdivided into smaller groups and the incidents 
that describe very nearly the same type of behavior are placed 
together. The definition for all the categories and major 
headings should then be re-examined in terms of the actual 
incidents classified under each. 

A major problem area in CIT involves actual data 
collection. The following items will be applicable to interview 
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or record form in order to collect human factors data in 



aircraft operation. 



1 . 



Description of the occurrence 

a. Aircraft 



(1) Model 

(2) Conf iguration when anomaly occurred (gear, 
flaps, thrust, fuel, quantity, etc.) 

b. Type of operation 

c . Time and location 

(1) Local time 

(2) Elapsed time since departure from parking 
area 



(3) Phase of flight 

(4) Geographic location 

d. Nature of the anomaly (describe the deviation from 
normal or expected performance as precisely as 
possible) 

e. Radio navigation facilities in use and type of 
navigation 

f. Detection of the anomaly (Identify the person 
responsible for each pertinent decision, command, 
action, communication or interaction with others) 

(1) Who first noticed the deviation? (Aircraft 
commander, air traffic controller, maintenance 
personnel, or others (explain)). Who should 
have? 

(2) What brought it to his attention? What should 
have? 



g. Cockpit environment preceding the anomaly. 

(1) Was there anything unusual about the operation? 

(2) Were there any distractions immediately before 
the anomaly occurred? 

(3) What was the weather at the time of the 
occurrence? 

h. What actions immediately preceded the anomaly, in 

order of occurrence? 

(1) Did any of these actions contribute to the 
anomaly? 

(2) What decisions motivated this action? Who made 
them? 
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(3) What information was the basis for the deci- 
sions? Was the information correct? 

i. Was there any indication before the anomaly that 
it was going to occur or might occur? If so: 

(1) What was the indication? 

(2) Who noticed it? 

(3) Was it noticed immediately? If not, why not? 
Recovery following the occurrence 

a. What happened after the anomaly occurred? 

(1) What decisions were made? 

( 2 ) By whom? 

(3) For what reasons? 

b. What actions were taken to correct the deviation? 

(1) By whom was each action initiated? When? Why? 

c. What effect did each action have? 

(1) Did it help recovery? 

(2) Did it hinder recovery? 

Did any complicating factors arise during the 
recovery period? (After the initial deviation, 
other events can occur while the crew is recovering 
from the first one. Be careful to identify these.) 

Was normal operation restored? How long did it take? 

Was safety threatened at any time? 

(1) If so, what was the nature of the threat? 

(2) Was it recognized at the time? 

(3) Who recognized it? 

(4) How was it recognized? 

(5) How long did it last? 

(6) What was done to control or minimize the 



d. 



(7) 



threat? 

Could the threat have been controlled more 



effectively? 

Background 

a. If pertinent, describe the history of the personnel 
involved and of the airplane and facilities utilized 
in this flight. 

(1) Nutrition and rest: Describe meals as to time 

eaten and type of food and sleeping time . 

(2) Were there any medical or physiological problems? 
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(3) Describe the crew's rest and duty schedule 
for this flight sequence. Was this flight 
their scheduled activity? 

a) Do the pilots believe the duty or rest 
schedule was a factor? 

b) Describe their activities during the 
preceding day. 

(4) Were there any problems within the flight 
crew with respect to discipline, coordination, 
ability, personality factors? 

(5) Were there any other problems (ground support 
personnel, controller, management, others)? 

(6) Were any other factors pertinent during the 
period prior to flight? 

b. Describe in brief the history of this flight prior 

to the occurrence. Emphasize any decisions, actions, 
events or omissions which might have been related 
to the later anomaly. 

(1) Was servicing and ground support normal? 

(2) Were there any supervisory problems? 

(3) Were there any ground or flight delays? 

(4) Were there any problems at the departure 
airport? 

(5) Were there any air traffic control or airways 
facilities problems? 

(6) Was weather a problem at any time? If so, how? 
4. Analysis and recommendations 

This section should contain only the opinions and 
recommendations of the person reporting the occurrence. 

a. Was the situation evaluated correctly when the 
anomaly was detected? 

(1) If so, were any special factors responsible? 

(2) If not, why was the evaluation incorrect? 

(3) Could anything have improved the accuracy of 
the evaluation? 

b. Was the detection of the anomaly as prompt as it 
should have been? 

(1) If so, were any special factors responsible? 

(2) If not, why was there a delay in detection? 

(3) Could anything have improved the speed of 
detection? 
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c. Was the recovery from the deviation the most 
effective? 

d. Was there any problem in flight crew management or 
coordination? Describe any deficiencies, problems 
or comments in detail. 

e. Was the entire flight managed professionally and 
effectively? 

(1) If not, what might have been done better? 

f. Was Air Traffic Control involved in any way? 

(1) If so, was the problem due to ATC handling or 
instructions? 

(2) If so, was there any flight crew misunder- 
standing of ATC handling or instructions? 

(3) Did ATC do anything to minimize the problem? 

g. Was any airplane system involved? 

(1) Did maintenance contribute to the problem? 

h. Was this a fairly common problem? 

i. Was pilot training adequate: 

(1) To have prevented this occurrence? 

(2) To correct or control it under these 
circumstances? 

(3) To cope with it under all circumstances? 

j . Were any of the following involved in any way? 

If so, how? 

(1) Flight crew supervision? 

(2) Flight dispatch? 

(3) Flight or ground support? 

(4) Other? 

5. Supplement (for interviewer only) 

a. Was the reporting person's memory entirely clear 
as to the details of this occurrence? If not, in 
what areas did he have difficulty remembering 
details? 

b. In your opinion, did this incident pose a threat 
to flight safety? If so, how and why? 

c. Add any additional comments or opinions you may 
have as to the factors involved in this occurrence 
and as to measures which might prevent such problems 
in the future . 



99 



After collecting the data by the methods given 
above, we can analyze the data. The sample size must be as 
large as possible for categorization. Table X is the classi- 
fication of pilot-error experiences as a result of analyzing 
the data. This is just an example to show how to analyze 
the data. 

In summary, the CIT is used as a method of dis- 
covering and attempting to reduce or control hazardous situa- 
tions before accidents occur. 

In effect, the CIT accomplishes the same end 
result as an accident investigation: identification through 

personal involvement of a hazard that has or could result 
in injury or damage. The CIT has been used in evaluation of 
pilot safety and has proven beneficial as a qualitative 
safety technique. 

D. OTHER STATISTICAL METHODS 

In general, accidents are not single causation events, 
rather multivariate factors. So we can use many kinds of 
statistical methods to analyze the data. Multiple regression 
analysis and cluster analysis are widely used. Different 
statistical methods can be applied to the collected data. 

The following is an example of the use of statistical 
methods. Suppose it is important to determine if there is 
a statistically significant difference between the pilot 
factor accident rates of experienced and inexperienced pilots 
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Table X 



Example Classification of Pilot Error Experiences 





Type of Error 


Number of 
Errors 


1 


Errors in interpreting multi -revolution instruments 

a. Errors involving an instrument which has more 
than one pointer (e.g., misreading the altimeter) 

b. Errors involving an instrument which has a 
pointer and a rotating dial viewed through 
a window (e.g., misreading the tachometer, 
air-speed indicator) 




2 


Substitution errors 

a. Mistaking one instrument for another 

b. Confusing which engine is referred to by an 
instrument 

c. Difficulty in locating an instrument because 
of unfamiliar arrangement of instruments 




3 


Reversal errors (e.g., reversals in interpreting 
the direction of bank shown in attitude indicator, 
reversals in interpreting direction frcm compasses) 




4 


Errors due to illusions: Faulty interpretation of 

the position of an aircraft because body sensations 
do not agree with what the instruments show 




5 


Using an instrument that is inoperative 




6 


Signal interpretation errors: Failure to notioe 

a warning light in the aircraft, or confusing 
one warning light with another 
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(in this case, the "experience" and "inexperience" would have 
to be defined) . Choose some time frame and let 

h^ = number of flight hours flown by experienced 
pilots 

h- = number of flight hours flown by inexperienced 
pilots 

a^ = number of pilot factor accidents involving 
experienced pilots 

a 2 = number of pilot factor accidents involving 

inexperienced pilots. 

Then the rates for experienced and inexperienced pilots are 
(a^ xl00,000)/h^ and (a^ x 100 ^OOJ/h^ , respectively. We 
want to test the null hypothesis: 

Hq! There is no difference in accident potential 
between experienced and inexperienced pilots 

H x : Not H q 

Testing Hq amounts to testing a hypothesis about the success 
probability in a binomial distribution. Let a and h be the 
number of accidents and time, respectively, for the group 
with the larger accident rate (e.g., a = a 1 and h = if 

the experienced pilots had the higher rate) . 

Let 

P = ^7% ' P = h^Th^ ' n = a l + a 2 * 

/S 

We will reject Hq if p and p differ too much. Compute 
T = P(X>_a), where X has a binomial distribution with 
parameters n and p. Thus, 
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T = 



n . 

V n ! 1 , , . 

* n in-IV T P (1 -P> 



n-i 



i=a 



Let a be the significance level of the test (e.g., a = 0.05) . 
If T > a/2, then accept Hq . That is, we would conclude that 
there is not sufficient evidence based on this data, to say 
there is a difference between experienced and inexperienced 
pilots. If T < a/2, then reject Hq and conclude (at signifi- 
cance level a) that there is a difference between experienced 
and inexperienced pilots. 

The above test is an example of a two-sided test. It is 
designed to answer the question, "Is there a difference 
between experienced and inexperienced pilots?" A one-sided 
test could be done to answer the question, "Are experienced 
pilots safer?" The null hypothesis in this case would be: 

Hq : experienced pilots are not safer than 

inexperienced pilots 

For this case, let a = a^ and h = h^, and compute T, p, p, 
and n according to the same formulas as before. We will 

A 

reject Hq if p is much larger than p. If T > a, we accept 
Hq. That is, we conclude that there is not sufficient evi- 
dence, based on this data, to say that experienced pilots 
are safer (with significance level a) . If T £ a, then re- 
ject Hq and conclude (at significance level a) that experi- 
enced pilots are safer. 
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V. CONCLUSIONS/RECOMMENDATIONS 



Aircraft accidents are rarely caused by a single factor. 
Generally, accidents are the end result of system deficien- 
cies, human error and design deficiencies coming together 
simultaneously. The most commonly designated cause of acci- 
dents is human error. For flight safety, a systematic acci- 
dent prevention program should include consideration of all 
possible sources. Accident prevention is best pursued within 
the framework of this program. There are certain fundamental 
concepts and methods which, if properly applied, can increase 
the probability of success in the determination of factors 
contributing to an accident. Several methodologies for the 
measurement of flight safety and data collection have been 
proposed in this thesis for inclusion in the K.A.F. safety 
program. 

The primary goal of accident prevention progam is to 
prevent mishaps. Therefore, the K.A.F. needs to develop 
a safety program based on the following data collection and 
analysis methods: 

1. Develop a format which will describe each element 

(e.g., pilot, maintenance, supervisory error, material 
failure) in detail. For example the U.S.A.F. has 
developed a system for accident data collection (see 
Appendix C) which provides for a comprehensive con- 
sideration of variables involved in flight safety. 

The following elements are contained in the U.S.A.F. 
data collection system: 

a. Ground mishap report. 

b. Aircraft flight mishap report. 



104 



c. Aircraft maintenance and material report. 

d. Life sciences report of an individual. 

e. Psychophysiological and environmental factors. 

f. Personal data. 

2. K.A.F. needs to consider the application of the 
critical incident technique (CIT) as described in 
Section IV to collect and analyze data. CIT is 
used in evaluation of flight safety and as a 
qualitative safety technique. 

3. Use the format of system safety hazard analysis (SSHA) 
for fault tree analysis. In system safety analysis, 
the results of SSHA should be used to determine what 
safety requirements are needed to minimize and con- 
trol hazards to an acceptable level. The SSHA should 
be accomplished by a systematic evaluation of each 
subsystem /component to determine how much each 
element/subsystem could potentially contribute to 

a specific hazard. A sample format of SSHA reporting 
is shown in Appendix D. 

4. Finally, the following fundamental data should be 
filed in the computer for use in a safety analysis 
and program evaluation. 

Group data 

(1) Total number of pilots engaged in flying by 
month and year. 

(2) Flight time of Command, Wing, and Squadron in 
month and year by model. 

(3) Total number of accidents in month and year by 
Command, Wing, and Squadron. 



Pilot 

a. Biographical data 

(1) Name 

( 2 ) Rank 

(3) Date of birth 

(4) Date of graduation from undergraduate 
flight training 

(5) Wing and Squadron assigned 

(6) Total flight time 

(7) Total jet time, conventional aircraft time, 
helicopter time 



105 



(8) Total instructor time 

(9) Total weather/instrument time 

(10) Number and type of accidents the individual 
has had. 

b. Accident data 



(1) 


Name of personnel involved 


(2) 


Date of occurrence 




(3) 


Type of mission 




(4) 


Phase of mission 




(5) 


Duration of flight 




(6) 


Type of accident 




(7) 


Prime and contributing 


factor 


(8) 


Days since last flight 




(9) 


Hours flown in last 24 


and 4 8 hours 


(10) 


Sorties flown in last 


24 and 48 hours 


(11) 


Hours flown in last 7, 


30, 60, and 90 


(12) 


Total time in this aircraft type 



In addition, similar data should be collected on main- 
tainers, supervisors, air traffic controllers, etc. 

Aircraft 

(1 ) Model 

(2) Total flight time 

(3) Date of last major inspection 

(4) Flight time since last major inspection 

Accident research is a systematic, empirical, and critical 
investigation of associated factors and their relationships 
in an accident. For this research, reliable and valid acci- 
dent data are necessary. If the data are collected in detail 
and correctly by the formats and techniques proposed, it will 
provide a convenient method for a researcher to use in the 
development and application of a safety program. For example, 
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the analysis of the variables or causal factors of aircraft 
accident such as human error, material failure or malfunc- 
tion, and adverse influences of the environment on man and 
machine will allow the researcher to develop an analytical 
model for a specific mishap. There are several multi- 
variate statistical techniques (e.g., factor and component 
analysis, cluster analysis, regression analysis, etc.) to 
analyze the accident data. These techniques can be used to 
determine significant interrelationships and to correct sys- 
tem inadequacies (i.e., what caused or allowed the accident 
to happen). Also, remedial actions (i.e., what can be done 
to preclude the occurrence of an accident) will be proposed. 

Finally, application of the findings and recommendations 
are needed. Qualified investigators, researchers, and safety 
officers are necessary at each level of organization (Figure 
21) and a feedback system should exist between and within 
each level. If a mishap occurs (here mishap includes major, 
minor accident, incident, and near miss) , it has to be inves- 
tigated and reported by a reporting system to Air Force Head- 
quarters Safety Section through the Command. In the H.Q. 

Safety Section the data must be encoded, analyzed, and recommen- 
dations made known by the dissemination of mishap results 
and findings should be passed to Wing and Squadron through 
the Command. The Squadron must then take action on this 
recommendation. The recommendations including general trends 
of mishap components must be passed monthly to Wing and Squadron. 
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Action 



Activity 




Report 



^6 



Analyze 






Dissemination 




Figure 21. Proposed Information Flow for R.O.K. 
Safety Program 
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Appendix E is a sample trend chart developed by the U.S.A.F. 
and applicable to the K.A.F. 

The safety program described in this thesis possesses 
the potential for reducing overall operational costs and 
maximizing aircraft availability. The end result of such a 
program can only serve to increase operational readiness 
and thereby maximize overall efficiency and military capa- 
bility of the K.A.F. 
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APPENDIX A 



BOOLEAN LOGIC AND ITS APPLICATIONS 

8oolean algebra was developed originally for the study of symbolic logic. Its rules and expressions m mathematical symbnls 
permit complicated propositions to be clarified and simplified. Boolean alqebra is especially useful where conditions can he 
expressed in no more than tv/o values, such as yes or no, true or false, on or off, up or down, go or no qo It has found wide 
application in areas other than symbolic logic. For example, it is used extensively in the design of computers and other 
electromechanical assemblies incorporating large numbers of on-off (switching) circuits. Other uses are in probability analysis, 
studies involving decision making, and more recently, in safety and fluidics. The chief difference between the various d'snplinps 
in their employment of Boolean algebra is in notation and symbology. Since the information in this section presents basic 
elements only, expressions most commonly found in safety analyses will be used 

A setjs a group of ob|ects having at least one characteristic in common. The set may be a collection of objects, conditions, 
events, symbols, ideas, or mathematical relationships. The unity of a set can be expressed by the number 1, and an empty 
set, which contains none of these, by 0. The numerals 1 and 0 are not quantitative values: 1 +■ 1 does not equal 2 They am 
merely symbols. There are no values between the two as there are in probability calculations. Set relationships are sometimes 
illustrated by Venn diagrams. The following rectanqle represents a set of elements that have an undefined common characteristic. 
In addition, a subset has the characteristic A. All other elements in the set do not have the A characteristic and are considered 
being "not A," designated by A. A is the complement of A, and vice versa. It can be seen that the total of A and A is the complete 
set, expressed mathematically by A + A = 1 , where the left side of the equation is the union of A and A The *■ sign is read 
'OR", and may be designated in mathematical expressions by other symbols, such as U. 
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The second diagram illustrates the concept of disj oint , or mutually excl usive, sets. The elements of one subset are not included in 
the others, and therefore are not interrelated (other than being in the same set). In this case, however, because A, B and C 
contain all the elements in the overall set, they are said to be mutually exclusive and exhaustive A +■ B + C - I 

The third diagram indicates that some elements of A also have 8 characteristics These are indicated by AB. A B or A^ B. 
called the intersection of A and 8 The intersection contains all the elements with the characteristics of both A and B When 
all elements with the characteristic A are counted, those in AB will also be counted The remammq diaqrams in the row illustrate 
some of the relationships between union, intersection, and complement Numerous other relationships that can bp «'mploved 
in mathematical expressions have been developed, some of them having been designed as laws. These are listed belnw, with some 
explanations on their meaning in Boolean logic. 



RELATIONSHIP 


LAW 


EXPLANATION 


A 1 - A 


Full and Empty Sets 


The only portion within 1 that is both 1 and A is 
that within A itself 


A 0 - 0 




An impnssible condition; if it is within the set, it 
cannot be outside the set 


< 

II 

O 

4 

< 




The element in a subset plus anythinq outside the set 
w-il have only the characteristics nf thp subset 


A + 1 » 1 




The whole, expressed by 1 . cannnt he pxcepdr>d 


< 

ii 

IK 


Involution Law 


The complement of the complement is the item itself 


A- A = 0 


Complementary Relations 


An impossibility, a condition cannot lie both A and A 
at the same time 


A * A * 1 




Those elements with a specific characteristic .md 
those without it constitute the total set 


A- A - A 


Idempotent Laws 


An identity 


A + A = A 




Also an identity 


AB 8-A 


Commutative Laws 


The elements having both characteristics have them 
no matter the order in which expressed 




no 



RELATIONSHIP 



l AW 



EXPLANATION 



A « B B ♦ A 

A(B C) * (A B)C Associative Laws 

AMB^ChlA+B)K 

A(B * C) S (AB) + (A C) Distributive Laws 
A MB C) - (A + B)( A + C) 

A( A + B) - A Absorption Laws 

A * (A B) = A 

A B = A ♦ B Duabzation 

(de Morgan's) Laws 

ATT - A B 



The total ol those elements having th*' i.h.ic mc.Pm ini u 
A or B will be the same no mjttei ibn older >n 
which they are expressed 

The elements having all the char a (.(ensues A. B and 

C will have them no matter the order in which ex (tressed 

The total of all the elements in any subsets will be 
the same no matter the order m which expressed 

The union of one subset with two others can also In* 
expressed as the union of their intersections 

The union of one subset with the intersection of two 
others can also be expressed by the intersection 
of the unions of the common subset with (be other 
two. 

A( A + B) * AA + AB - A + AB since AA - A, 

A + AB - A ( 1 + B) - A smee B is included in 1 

A + (A B) = A + AB - All + B) * A 

The complement of an intersection is the union of the 
individual complements. 

The complement of the union is the intersection of the 
complements. 



Other useful identities are frequently used for simplification of complex Boolean equations. Four of these are: 



Identity 



Derivation 



A + AB = A * B 
A*( A + B) = AB 

(A f B) (A + C) • (A + C) - AC + BC 
AB + AC + BC - AB + AC 



GATE (CONNECTIVE) SYMBOL 

A + B 




AND 



NOR 



NAND 



A • B 




Using the Distributive Law: (A + A) (A + B) A ^ B 
Using the Distributive Law: A A + AB = AB 

Expanding the last two terms_(A + B) (AA + AC + AC * CC). CC = C. 
AA = 0, AC + AC - C( A + A) = C( 1 ) = C. and C * C = C. 
remainder is {A + B)C, or AC + BC. 

This can be simplified by adding aterm such as A *■ A The left 
hand side then becomes; AB ♦ AC + BC(A + A) - AB ( 1 +■ C) ► 

AC( 1 + B) - AB + AC 



EXPLANATION 



TRUTH TABLE 



The OR connective indicates that when one or 
more of the inputs or governing conditions is 
present, the statement will be true or an output 
will result. Conversely, the statement will be false 
if, and only if, none of the governmq conditions 
is present. 



A * B JDR 

0 0 0 ~ (False) 

0 1 1 (True) 

1 0 1 (True) 

1 1 1 (True) 



The AND connective indicates that all of the 
governing conditions or-rnputs must be present 
for a statement to be true. If one of the conditions 
or inputs is missing, the statement is false 



A B AND 

0 0 0 (False) 

0 I 0 (False) 

1 0 0 (False) 

I 1 1 (True) 



The NOR connective may be considered a "not OR" 
state It indicates that when one or more of the 
inputs is present, the statement will be false or no 
output will result. When none of the inputs, neither 
A nor B. is present, an output will result. 



A M3 NOR 

0 0 1 (True) 

0 1 0 (False) 

1 0 0 (False) 

1 1 0 (False) 



The NAND connective indicates that when ajj of the 
inputs or governing conditions or inputs are no! 
present, the statement will be true or there will be 
an output When at! of the inputs or governing 
conditions are present, the statement will be false 
or there will be no output. 



A B NAND 
0 0 1 (True) 

0 1 1 (True) 

1 0 1 (True) 

1 1 0 (False) 
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HUMAN ERROR I I Material Failure 



APPENDIX B 

FAULT TREE DIAGRAM FOR CRITICALITY ANALYSIS 
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vibration 1 i wear 




APPENDIX B CONTINUED 
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APPENDIX B CONTINUED 




O 

CM 

CN 



CN 



CN 



< 7 * 



<N 



00 



<N 
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Inadequate 

Adjustment 



APPENDIX B CONTINUED 
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APPENDIX B CONTINUED 
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Solenoid 



APPENDIX B CONTINUED 
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Hydraulic System 
Failure 



APPENDIX B CONTINUED 
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APPENDIX C 

REPORTING FORMATS FOR DATA COLLECTION 



GROUND MISHAP REPORT 

fC nrwpl*t* • 0(|lr»M« If •(***) 



•• 


OR«N. COmO 4 


• Aft 


• WTUI TTINO 


app r 


If 
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>. * 


.LvEUlTv CLASS 


4 . 


pa jC BiU COOL A n 


apt *• «i *l n 


























* 




C 




































NON-OPl 




B 




HAP 
















«. 
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COML 
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MON T H 
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O a 
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CMV 
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ON 
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NO. 
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C. OUTT AMC/ 

JOS SCPICS 


O. ACC 


c. 


SE * 
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IK MILITARY 


lil CIVILIAN 


« 1 1 
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ILL/ SI CP 
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NON. PA rio 



J . 


DISABILITY c 


LAS 
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tai RCOUIRIO lur NO T uSCO (Ent** U*m **4 itthmHr) 
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IN VOL V C O 


O. 


JO • training 






OiPCC TL Y 


PCOUiPCO | 


RES 




NO 
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R. ACTIVITY at timc op mishap 








.__.L1 .v- 


1 V can 


1 i 


|ovCP S YCAPS 



4. VEHICLE . aircaaet aepoRTCO no. 



A. PMV 


*1 


VEHICLE 








AUTOMOWIL C 








vO TOPCYCtC 








" 3 TU l R 

^LSp.tUy) 



roimo act/cst 



O. TP. « • MA*« 



a. citations istuco (Spmcur) 



N. YCNICLC *C Tl VITT/R040 Su*r ACC 



TV«(/OKIlCNA TION PPOPCPTT OAuMIO 



I. OPERATION 




ON PO a o 




ORR POAO 



USA f PROPERTY OAMAOC 



J. OAMACC COST 



• . OPNCP (KAjCOHf 



C. OCSCPIAC OA 



o. POPPNOUPI TO PCPAIM 


C. LA90P COST 


E, MA T CPI AL COST 


O, TO T AL COST 











TOTAL MISnAS COST 





A. A 0 IMJUP Y 


9, AN PPTY O AM A 9 C 




O, TO f AL A 9 LOSS 








IS, U S A R nCPOPTlNW ORR'CIAI 


L. f TrpP P4«*4. ('•*• • fM IIM#J 




•9. OA T t 


JO. PISPONII • L E C OMOP/ P UN C TION AL M«P ( 
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119 



1 MISHAP CLASS 
G A □ ■ 


2 ACP T MOS A 
SERIAL NO 


J OATS 


4 UNIT CONTROL NO 


s Acrr assignmsnt/status 
COOK 


□ c 


□ OCST 











AIRCRAFT FLIGHT MISHAP REPORT 

(To be filled out for onnupal aircraft involved I ppropnute itetnt onlv snoutJ be filled out on secondary aircraft ) 



pilous) involveo (Flight cnewr 



operator at controls 



A. LAST NAME, initials 


a COMPONENT 


c. POSITION IN AIRCRAFT AT TIME OF MISHAP 


O. NATIONALITY 


C. AGE 


|tront seat) {left seat) | rear scat| [pigmy SEAT 


] JUMP SKAT 


r. majcom, nap. oiv. wg. so assignco 


G. MAJCOM NAP. OIV. WG, SO ATTACHKO FOR FLYING 


7. OTHER PILOT 


A. LAST name, initials 


a. COMPONENT 


c. POSITION IN AIRCRAFT AT TIME OF MISHAP 


O NATIONALITY 


E. AGE 


|fronT seat] | LEFT SEAT [ [ REAR SEAtj j RIGHT SKAT 


r 


r. majcom. nap. oiv. wg. sq assignko 


G. MAJCOM. NAP OIV WO. SO ATT ACHCO FOR PLYING 


• other pilot 


A. LAST NAME. INITIALS 


a. COMPONENT 


C. POSITION IN AIRCRAFT AT TIME OF MISHAP 


O. NATION A LIT Y 


E. AGE 






P. MAJCOM. NAP. OIV. WG. SO ASSIGNKO 


O. MAJCOM. NAP. OIV. WO. 50 ATTACHE© POP FLYINO 


«. OTHER PILOT 


A. LAST NAME. INITIALS 


a. COMPONENT 


C. POSITION IN AIRCRAFT AT TIME OF MISHAP 


O. NATIONALITY 


K. AGE 


jpRONT SEAtj j LKPT SKAT] | REAR 5 E Alj j RIGHT MAT 


J JUMP SEAT 



r. M A J COM. NAF, OIV. WO. SO AfSIGHCO 



G M AJCOM, NAF, OIV. WG. SO ATTACHKO FOA FI.VINO 



clearance 



f ROM 

m 



ft to ft 



AIAWAYS 



T J NO CUC A* ANCI 



OURATION OP FLIGHT 



I 2. TYFI 0^ MISSION 



11 ALTlTUOC/(LCV ATION 



14. FHASI or OMSATION 



is. type or MiiHAr 



IS. MIUOAOLOGIC AL CONOITIONS 



□ VMC GfIMULATIO I M C GthaNIITION 

Qimc C3on Tor Qvrn in imc conoitions 



AIRFIELOOATA APPLICABLE TO TAKEOFF ANO LANOING MISHAPS OCCURRING WITHIN 2 MILES OF AIRFIELD 



A. P IKLO elevation (I eet) 



a. composition or runway 

□ asphalt □ concrete Qoth « m(Speci fv) 



c. length op runway 
(beet) 


O. RUNWAY HKAOING 


E. OUT.YNCK OP TOUCHOOwN 

» sJ ■ i a sitM aw /L ji 


r 


SURFACE CONDITION 






riYY PS T f 9 TE(/ 


Gory Qwct 


OTHER (Specify i 


O. LKNOTH OP OVERRUN 


H. COMPOSITION OP OVERRUN 


1. barrier 




(specify/ 




TYPE 


usso 

□ YES □ NO 


LOCATION 



A • CONOITIONS Arr EC TING OCCUAtNCt (b'or e sample. t \ pe of instrument or Ugh ting approach used, obstructions barrier airspeed, g mu 
weight, forced landing i 



K m.tn- than tour pitots an' iMmti nl (I light ( n'p,»rt tame information rromrej on at JJihonai fficct hit each 
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AIRCRAFT MAINTENANCE AND MATERIEL REPORT 



I. SCPI«L HUMPE* 



*• mission of s i on an o scuts mosi 



HISTORICAL OATa 



Al PCPAFT 



LEFICICM PART COMPONENT OR p'.CESSORY 



in ro»cc *c c c • T *n c t oat* 



total n.i<5*T -ouas 



A » A T NlMBCI 



LAST OvEANAtjL 3* T C 



* C f E°l-NCE 



OVCAN AUt I NO ACTl VI Tt(/V«"» * Loc) 



nOUAS Since Ov(»n* w i 



H0L-A5 SINCE LAST S^NEOULEO INSP. 



•OP* LN I T COOC 



OATt or LAST SCHPCVLCO INS^CC'ICN 



tqp A E Qu E S T f 0 



TYPE 0* LAST SOEOULCO INACTION 



HOP SUSHI TT*0 
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MO P numAEP 
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EnG l NE 
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ENGINE HOOEL ANO S E • ♦ E 5 
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ITEM AND SERIAL NUMBER 



noups SINCE 



OIL CHANGE 



houps since 



OIL CHANGE 



damaged AIRCRAFT 

(furnioh complete demege inf ormo t ion under Teh 



See AF Form 71th) 
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COST IESTIMATEI 
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SYSTEM 
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SYSTEM 
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SYSTEM 
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lli. PSYCHO PHYSIOLOGICAL* HD EMV I RQMMEhTAL MCTG^ 

INSTRUCTIONS: Complete on il I occupinti of •ircra/t, 

• 11 injured ptrioni, and *11 prriom poi libl y con* 
trlbuting to the eau»e of the m »h»p. Supirvi iory 
ftctor « attributed to pf riom not in the aircraft 
and auch factor a a a detign or weethar ihould be re* 
ported only for t ha peraon in primary control of the 
aircraft. Factor a contributini to injury during 
■ ld*air colli nona, craah landin(«. ditching*, etc., 
ara to be conaidered part of survival phair. Uaa 
code* at right to ahoa only thoae factora preaant or 
contributing in aach phaae. 
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CNANNtLI2(0 ATTINTION 


• 22 












faulty aafFLiGNT of ancaarT 


20 2 












01 S^AACTION 


9 2 3 












FAULTY FaCFAaaTION OF F C a JON AL COU'F. 


203 












FatOCCUFAT I ON aiTMFfasoNAL a*OIU-i 


• 24 












Nua»»tO otFAatuac 


20 A 












CtCCIJIVt MOTIVATION TO succtto 


4 23 












OCLAVCO oteaaTu *t 


203 












OYfACONF 1 OtNCt 


• 2( 












iNAOCOuaf* at A Tn C a analysis 


20* 












LACa OF s CL F*CONF 1 OtNCt 


• 27 












OTHta ( Spec i fy) 


It* 












LACK OF CONF 1 OtNCt in tOUlFMfNT 


• 2 • 
























AFFAtNtNj ION 


• 21 












3. CXPCRt ENCE/TRAiNING factors 












PANIC 


• 30 






















OTNta ( Spa« i fy) 


• •• 












I NAOCOU a Tt T a AN J 1 T 1 ON 


30 1 
























LIMIttO TOTAL CaFCaiCNCC 


302 
























L laa 1 TtO ACCCNT CxFCAKncC 


30 3 
























failuac TO uit ACCfFTto aaoctouats 


JO A 












7. ENVIRONMENTAL FACTORS 












0 tnc a YSpac i if) 


3*a 


































ACCtLCaanoN roaccs. in.flignt 


701 












4. OESlCN FACTORS 












ACCELERATION F0act3. imfact 


70 2 






















Of COMP «t 3 3 1 ON 


70S 












OCSION OF INSTauMtNT). CON T aOL 5 


AO I 












V 1 •••T ION 


70 4 












LOCATION OF INSTauMtNTJ. CONTROLS 


A 0 2 












GLAAC 


70 3 












failuac of instaumcnts. controls 


AO 1 












SMOKC. FUMCS. tTe. 


70 t 












COCAPt T LIOMTINO 


A 0 A 












N t AT 


707 












*UNAAY LIONtlNO 


AO 3 












COLO 


70 • 












LIOMTINO OF OTHta aiactAFT 


AOS 












* 1 NO SLAST 


7 Ot 












PCASONAL COUlFMtNT INTCAFtACNCt 


AOT 












V 1 3 . at STA .. at A T nCA. n A 2 1 . 0 A ak n t 3 s 


7 10 












VORKSPACf INCOMFATlfLt ■ 1 TH MAN 


Aoe 












vi 3 . atsra. • icino. ainoows foggco. etc 


.711 












OTMga (Specify) 


<te 












VI 3 . at STA . *0u 3 T . SMOHt.tTC.. IN AC F T . 


7 1 2 
























•CATNta. OTNta Than VISIBILITY AfST# 


. 7 • S 












€ ^ Aaaji iy | ^ i f | ah ff B Dfk flfl CUC 














OTnta ( Jp»< i fr) 


7t t 






































mi siNTtaeacrto communications 


SO l 
























OljauFTtO CO*«MUNI CATION 3 


SOI 












t. OTHER FACTORS to SC CONStOEREO 












lancuaoc taaaica 


303 






















NOISC INTtaFtatNCt 


304 












n a 1 1 t i n r t af ta . . usto vaono control 


• 0 I 












OTHta (SfCify) 


set 












CONFUSION OF CONTROLS. OTnCR 


• 0 2 
























Ml 3*(«0 1 NJ TAUMCNTt 31 


• OS 












«. PSVCMOPMYSIOLOCICAW FACTORS 












MUl NTtAPVt TtO INSTRUMENT At A 0 1 NO 


• 0 4 






















hislco #y faulty instrument 


90S 












FOOO POI JON 1 NO 


to 1 












yisual at j t* *y COVlP. BTAuCTuetJ 


• 0 • 












motion SlCANtJJ 


• 02 












rasa 0 vc as a ru * a t i on 


to 7 












OTHta ACurt illncsj 


• 0 s 












INA0C0U4TC COOAOINATION oa TIMING 


909 












OTNta MC-CiijTiac Olft AJt/OtFtCT 


• OA 












mis JU OG f 0 satto oa OUtanCI 


90 • 












ct r.NOMt ITU 


tOJ 












SCLtCMO «aONG COuaSt OF action 


• *0 












N AN GO y t a 


• 0« 












OCLAv in IMIAG NtCCSSAt-r ACTION 


• l 1 












JLtCF OtFaivatiON. faMouC 


• or 












V'OLA'ION or niGNT OiSCiaviNf 


9 i 2 












faTicuf. otNra 


• 0* 












N AM 1 G A * 1 ON AL t A An • 


• 1 ) 












MUJCO m t al J 


• 0* 












i n aovc a r t s r oat* s f L f inoucto 


9 i 4 












0*uG3 a at SC R t at 0 at MtoiCai omci* 


« I 0 












1 *1«0»I AlfMl 0»l» MfCHANICALLV 1 NOUC 


• l 4 












0*ug s . OTNta 


t * ' 












i 'mi i i Jrin ir) 


Ml 












ALCOHOL 


• 1 2 
























N Mat OF INOl VIOUAL 


SS AN 



phases OF mi shap 
a • acc t OCn r 

t • tsearc 

L • LANOINO 

J * Juavt val f /"c Jvdei 

parachwta Jandmga) 
a • aucuc 



FACTOR IMPORTANCE 
o • oer ini T tcv 
CON rai t^TCO 
J * SuseccTtO racroa 
a • C ON 0 ITION a a t 1 1 n T 
•UT 010 not con. 
TA I tutt TO ACC I • 
OCn T oa injuav 
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personal data 



ROLE Of THtS INDIVIDUAL IN THE CAUSE OP THIS ACCIDENT 



1 2 . *«Q». | I 



CON TIKUTlNl 



• - unknown 



QUTY OR »OU 4 T Tint Of ACOOCNT 



BA CKGROUND DATA (Cpmolmta for »ll pi lot* «nrf olAar* »h« po«i ibly cowTrtAuTatf t» m J 

a. oa*s ol> ■ * t on ' l * sT 

LI A VC 



, OATC L * 5 T L C A v C 
INOCO (DtfMo.-Yr ) 



rv»C Of LAST LCAVC TAKtN 





1 . OAO. 




1 . 0 C C N L 1ST. 




$. SICK OA 
CONY A - 
LCSCCNT 




* - OCLAY C N A . 




2 . CMC4G. 




4 . CAAOUAT 1 On 




• . UNKNOAN 



0 A T c or LAST mcvio 
r L I CM T ( . - Yr . 



C. MOU«S riO«N IN LAST 24 
HOUM 



f. hou«s r l o • n in last «• 
HOURS 



O. S 0* Tl|S 'LOAN IN last 
2 A MOUAS 



SORTICS TLOAN IN LAST 4t 
HOURS 



I. MOUAS VOAACO IN last 24 
mOUAS 



J. HOUNS 40AACO IN LAST 4f 
MOUNS 



*. MOUAS SLEPT in last 24 
MOUAS 



MOUAS SL I A T IN 
LAST 41 MOUAS 



mOuas continuous 
outy a ai on TO mi }• 
hap 



MBS. CONTINUOUSLY 
A • AH C * A I 0 • TO 
M I SNA A 



o. mou*s ou a at ion or 
last SLCCA AIAIOO 



a . T I I 4 C IN COC* a I T 
A A | o • TO r l l C m T 
(Mr a. . Min.) 



DAT! LAST AACYIOUS 
ACT. THIS MOOCL 



ouaation aacvious 
r lt . TM I S UOOC L 



OCALOYCO UNITS 



S. 0 A T I OCALOvCO 



T . NO. DAYS IN AAC A 



PHYSIOLOGICAL AND VERTIGO TRAIN! NG (For til 00 r—nntl) 



TYPC Of TRAINING ACCOMALISMCO 



ALACC TRAINING ACCOMALISMCO 



comalctco 



ROLC i 

1 N 

M| SMAA 



4 . 



ANTHROPOMETRIC OATA 



07 VuTTOC« .ANCC LCNCTM (tnchVm)~ 
m". LC« LCNGTM (Inch**) 



A. OATC or OIATM ( D*y • Mar* ( A- Yrar ) 



0. SITTING MfIGHT (InchMA) 



R. m( • Cm T ( Inch ••) 



c. TAUNI M| I CM T (tnchmt) 
r . FUNCTIONAL A £ ACM ( I n c h 9 9 ) 



C. VC I OH T (Lk A. ) 



1 . shoulocn aiotm isiocltoioi 

( tn«h 99 ) 



s. total ycaas or roRMAL coucation 



e. 



GRADUATION PROM UNOERGRAQUATE FLIGHT TRAINING 



AVIATION SCHOOLS ATTENDED SINCE GRADUATION (Inciu 



0 . 



FLYING EXPERIENCE 

(Atfch capjr aF indirido9i ••riri««t 4 i* aw tlir>9d by i/f Uf*J) 



A. TOTAL rLTINO MOUAS (Including AP timo. •»•<•«* •«<* 

9 th 9 r Accra dlt 9 d (i««) 



C. TOTAL TIM! THIS AIACRA4T 



R. TOTAL JCT TIMC 



0 . total a c a tm c a instaumcnt mouas 



flRST PILOT AN0 
INSTRUCTOR PILOT mas. 



ALL a • ac* a r t 



This AiRCRArr 



SORT I C S THIS 
A I AC A A# T 



O.ORIOINAL IJAONAOTI . 
CAL AATINC 440 0 A T | 



A. P A£ SC N T 4£ AONAUTI . 
CAL • A T I HQ ANO 0 A T C 



0 A T C or last Cm C C* 



s. INSTAUMCNT 



T . F AO r I Cl CNCY 



OU TY 



9 . • 



aviation SERVICE COPE Hying activity CATEGORY iu/i, nj/l. ETC.) 



CUAACN T 



AAf V | OU S 



a A c v I OU S 



Nanc or inommOi-al 



i flf rill in mi « A A A Mr A* > 1 . ( A • f*/fo*«n $ ro 4 f • ■) (( Hr iw*d> 



9 - *9 impart mrt 
i • Traininf d»f,nt f • I r 



7 . T r 9 1 n in g pn,9,hi , h ifp.rf 
) • L«rl A f tram 1*4 ! tt t * 



4 *L acI a l tt 9 inin% 909 h6/i factar 
f - U f» 4 n o •« 
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LIFE SCIENCES REPORT OF AN INDIVIDUAL INVOLVED IN AN AF ACCIDENT/INCIDENT 
SECTION A, AIRCRAFT ACCIDENT/INCIDENT 

{THIS FORM IS AFFECTED 8Y Till r*t\ IO \C~ OF / ) * 4 - SEE LAST PACE) 



I. 



PLIGHT DATA 



1. T t A A A 1 N CLCAAANCC AT 
T i m C 0» €«t*5CNC> 

(font) 


2 . C AS i n * L T l T U 0 E AT T g{ 

Of t M f AGENCY f*#f) 


7 


CtCuO CONO 1 r 1 ONS 










0 . CL C a A 




i . ovc»c»sr 












* , iiuACir A t T 








3. 


TIME AT CA0IN ALTI TUOC 










3 * in CLOuCS 




MOU AS 


Ml Nu TC $ 




A. * N ANC 0U r OF CLOU OS 




«• 0 TMC t ( 5 P a c i f y ) 


4. Im||(NT AL Tl TuOt AT T|Mt 

Of CmCAGCnCY <?•**) «SL 


5 TIME AT AM0 1 EN T 


a 


HQRI zon 




ALT! TUOE 








t* 08SCU »I0 






MOUAS 


M 1 NU T t S 
















I>OTh(» ( Sp*e 1 f V) 






1 


9. 


PLACE in 


roPMATl ON 












i 




• • S 1 NGL t A l «CA ATT 


| L • L C AO 


j *• • 1 NG 


9 


DU°A Tl ON 


Of 


FL 1 GhT 


1 



T. OTMC * ( Sp*c J fy) 



MEO I CAL I H FORMAT I CM 



t. DEGREE of INJURY 








1* NONC 




1* MAJOR 




»• Ml ss* 

NO 

L ANO 




2- Ml SSI NO 
U Nl N o • N 




t* Ml NO A 








••Ml SS- 
' NO 
a AT r A 




••minimal 



a s -OS»i f»LlJC 



a. oaounoc o* ou »a r 1 ON (Onyt) 



3. IN M 



5. unCOnSC!CuS-OU®aT«C\ 



HOU* S 



* I NU Tt S 



Imcntion of Infury /) E*tnrnml C«ui« C Im* ’’ AJ»o ifdicilf « nd cod • Location, 

phot* of Ml chop, nod Problem* ( t i <i* J) . S#» AFV 127*1 * or ipfci/ic «n#frucf ioni j 



CCOE 



A. NATUAt ANO LOCATION 
1. CXTCANAL CAUSC 

C. LOCATION. PHASt Of MISHAPS. ANO paoALCMS 


























A. NATU»t ANO LOCATION 
1. CXTCANAL CAUSC 

C. LOCATION. Phase Of MISHAPS. ANO P AOtL CMS 








] 
















1 


A. NATUAC ano LOCATION 
1. CxTCANAL CAUSC 

C. LOCATION. PMASe Of MISHAPS, ano * AOtL CMS 












' 














A. NATUAC ANO LOCATION 
I. CXTCANAL CAUSC 

C. LOCATION. PHASt Of MISHAPS, ano p AO AL CMS 
























1 


A. natuac ano location 
1. CxTCANAL CAUSE 

C. LOCATION. PHASC of MISHAPS. *N0 *AOtLCMS 








i 






i 






i 


7 - LABORATORY TESTS 


TISSUE TESTED 


METMOO used 


LA8 TESTING 


RESULT 


CODES f */-«* 


CAAtON MONOXtOC 


















ALCOHOL 


















LACTIC ACiO 
















! 


0 ThC A ( Jppc i ty) 
















i 

i 



t. a.aav ac Sul ts 



•♦ 0 1 SCASCS/OCf CCTS PACStNT At TIME Of MISHAP 

01 AONOSI S 


VE"WC0 Of 


OI5COVERY 


AAI'.ERS (An nppltcnbln) 


ANNUAL 

PmYS 


SICA 
C all 


A u T C P S Y 


? thC A 


• U Tho • I ty 


OATJ 


v »0 . | ’>'*** 














j 














! 














... | 








1 






1 



10. 



MJTOPSY CONDUCTED 9 Y 



MATERIA*. SLPVITTEO YC AP|P 



M* MIL I TAAV 

P ATHOLOQI ST 



f*PLlCMT SUA6C0N 



I • *u TOP st M»o»r 



3- * i C TUAC S 



C* C I V»L l An 
A ATHOLOCI ST 



a- paojcn r i ssl t 



a. 1 1 1 c o r i ssue 



It. ftCMA»«S OA CONTINUATION Of AtOYf 



l J. human »tll *tl L I * 0 S I T I ON 

I 1 S I I NO 

H»Mt 01 l NO I V 1 Ou *L 



ASS* GN f o UNI 1 



UlftH' mOS 



OAfC 0 f A S S I CNN t *• * 



C^N* » 0 U' 0 



«: • i r i r ai 
? a re o* «>»-*» 



LEAVE P14-.K 



N*l * ' C *1 
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2 



A. 



TRAINING RELATED TO THIS ACC I DENT/ INC I PEN T 



scfor other) training 



NAM<- OF CO'jRS£ o*» Ojr 



AP’truOE SCOOTS i®PLIC* 9 L£ 



V. 



PERSONAL AND PROTECTIVE EQUIPMENT (Spectfv ail appl tcabl - ittma of equipment 

on appropr i at e I ma and indicate all t yp e a of clothmi an.o «nv other equipment that influenced operation) 



NOMEHCL ATuRE 1N0 
M006L DESIGNATION 



I avail- U5€Q 

3UI «EO | A0LE j 



•*««« I cSilco 1 ' :i5r 



x E A 0 PROTECTION 



CrE PROTECTION 



6 AS PROTECTION 



BRE ATH I NG AID 



CLOTHING WORN 



90 QV RESTRAINTS 



COMMUN I C AT I ON 5 



SEAT 9/OR OTHER E OU I P . I 



TYPE WARNING I SSUEO 



OTHER ( Spwci fy) 



VI. 



VEHICLE/EQUIPMENT 



MAKE 


MOOEL 


NO. OF 00 0 R S 


INSPECTION CERTIFICATE 

OATE __ 

MILITARY CIVIL 


P AODEO OASH 


TINTEO 
d 1 NOSH 1 ELO 


RECESSEO STEERING 
iTMEEL 


| l-VES | | 0-NO 


[ 1 *Y ES | | 0-NO 


1 1 -yes I I 0-NO 





MECHANICAL CONOITION (Indicate by (a) Satiafactory or (u) t/n a at i a f ac to ry ) 



0* STOP LIGHTS 



e-oi rectional signals 



P-HEARVIER mirror 



G-EXhauST system 



•STEERING MEChANI 5 M 



J-R/SH1EL3 RISERS 



»QTx[r rSoTCi^y) 



VII. 



CAUSE OF INJURY OR DEATH 



A* STRUCK STEERING COLUMN 



8* *»l NOSH I ECO 



0-01 5PL ACED C 9 J EC T 



E*OOORFR AME 



F • I NTRtjOING OBJECT 



h-OROwneO 



J-PEOESTRIAN STRUCK 
BY VEHICLE 



1-EXPOSURE 



U* CXPLO SI ON 



M- STRUCK SU9MERGED 
0 8 J E C T 



VIII. 



ACCIOENT AREA AND CONDITIONS (Specify all applicable t t e* a ) 



T I ME OP QAVftoCRi ) 



3-L I GH T | NG 



I • SATI sf actory 



O-UNSATI SF ACTORY 



TYPE OF 
SURFACE 



ROAO 

CONO I T I ON 



TYPE OF ROAD 



POAO 

CONFIGURATION 



1-CONCRETE 



l-ONE LANE 



I- STRAI GH T 



2-MAC AO AM 



2- TWO LANE 



3- THREE L*nE 



4-LOOSE GRAVEL 



4-F0UR or more lanes 



4 -CURVE ANO BANK 



S-OIVIOEO TO. L a 'i E 



S- I N rE*SFC-! ON 



S-0 I VI OEO 'ACRE ru AN 



IX. 



COMMENTS 



Tm I 5 SECTION I N C L L. 0 f S ' M i C I C * L , P f R SON AL AND f •, . I • <* W ■ *. * 'L * ’ * » ■" ‘ u * - f % *IT* * r « | n 0 

OR INJURY CAUSATION. Th£ ANALYSIS 0 f ALL FACTOR' « . M(plC*L O ‘ * I f. E 8 5 , ‘I 1 “ APPROPRIATE a»CO 

first hand o 9 sc R v a t i o*»s is oe~iREO. in^LwOF r -« s l 1 * •' l ‘ . t ;r a-.-i.itjex o« prf.iqus 

SONS P05SI9LT CONTRIBUTING f 0 MISHAP.) (Continue ur» mid t I to n a I aheet if neceaeary) 



" I r f N r ANC/ 
8 a S E 0 ON 
; I T 0 • all *»?•• 



n nl ) 
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VI. EGRESS * SURVIVAL GENERAL (Complete for all individuals) 


|. LOCATION IN AIRCRAFT 


*. OKOCK or tSTAKC (1 |l, 2 nd, etc.) 


A . 




t • COCK * r t o k »IL 0T*S COMKAf TNCNT 




2 - nkvI r.ATOK* s^fNGINCCK* s conk* k-nCn t 


7 PEA SON ( S 1 FOR ESCAPE 

(Pore than one way aoply) 








A • K AS S CnGC K * $ CCNKAKTMCNt (Upper deck) 




A* r | Rf / f I K|. OS 1 ON 




;•«*’{• )W»ACT 




S • K asSCnGC k ' S COnKkktmCnT (Lower deck) 




• •LOSS or CONtKOL 




H- G p Ou N 0 S T KijC . JMKACT 




• • 0 Tm C • COmkaktmCnT 




C-CNOINf KAILUKC 




J-LainCm FailuWC 




• • COMKAKTMCNT unknown 




| 0 » rulL f »Miu5T 1 OS 




K- IKQ[ 5 T V( S r r K 1 Lu WC 


• . 


LONGi T vO'nal LOCATION 




j C • S TKUC Tu K a L * * 1 L U K C 




* -OTHt* 




1. roKWAKO S C C T i on 




s. l»T SCC^ION 




[ f *W l 0- A I K COL L I S I ON 




l • UN* NO KN 




2 . CCNTCK SCCT'Cn 




«. SCCTlON UNKNOWN 


9 


COMMUNICATIONS PPIC'T to ESCAPE 



LATCRKL LOCATION 



l-OlSTWCSS SIGNAL TMNSM|TTf3 



5 . >1 IttT S > Q | 



2 • ros i t i on rt* tmssmi rrco 



4. LCTT stOC 



». UNKNOWN 



j*fvtr»cCNC v 



\ ft ( Venue / > 



01 "CCT ION * AC ING 



‘•f Mf •tfscy irr (Automatic) 



S. SIOCKARQ- 



• - UN* NO<N 



I. UNt N0*N 



use or scat 



NCM0EP OF PREVIOUS 



2. 



$. NOT in 5 t * T 



t. IN SCAT 



2. IUN»/l|TT[» 



f JIC T I ONS 



•- UNKN0»N 



t«f*GCNCy 
C»U *£ JUMPS 



m£ THOD Of ESCAPE (* 



>1 v> 



OImM paRKCn^T* 
JU“KS 



l - tCCOMWi I s»CQ ffrww of aircraft) 



2 • A T T (mK TC 0 ( 0 id not c Itmr aircraft) 



TERRAIN OF PARACHUTE L A\ 0 ! Nf,/ C 8 A SH SITE 
( ttoro than one mj,y apply) 



7 • UK* NOWN If ATTCmKT WAS M 4DI 



»*o»cn s f • 



m-OCnSC "CO os 



••UNKNOWN, SU3WCCTC0 CjCCTION 



fl-LARGC L‘M 



0«OCFINlTCLr NOT attcmktco 



T-Tm»ouCn races 



t - ACCONKl. t SMCO (Praa of aircraft) 



0 »OCCK kkTCR. 0 Tm t a 



•••iviNC/srttP slokc 



2 • A T T ( M* T( o (Dirt np t claat aircraft) 



(•Shallow *atc» 



T*OtC» SNOW 



••IN/NCA* MMCSALL 



••Unknown. SuSKCCTCO OAILOUT 



G-TmiCK ICC 



0*0Cr INI TCI.T NOT KTTCnKTCO 



••haksm/skamk/wuO 



A-STANQAKO CmCRGCnCY GKOUNO cgkcss 



I-mRRO GKOUNO 



2 -UNKNOWN 



J-OIO NOT CSCAKC 



j-sorr ground 



Y»o TnCK ( Or it r i A* ) 



w CIlT UN A 3 S I S TC 0 (Othar than atandard 
* amar ganay ground agraea) 



• ••U ILOING 



U’MOUNT A | NS 



L • kunwaw/OvCkkljn 



S«c ARRI CO/ ASS I STCO OUT 



• - «L0 wn/ TNKOWN out 



»». AIRCRAFT ATTITUDE AT TIME Of ESCAPE 

(Either in flight or aflar craah, ditching, at a.) 



••unknown i r cscakc accomklishco 



* • C SC A K C . mCThqq unknown 



3. 



INTENT FOR ESCAPE 



2- UNI N TINT . 



• »UNK NOWN 



I • * l C h T Sank 



0*LtPT sank 



EXIT USEO 



A-NOSC OOkn skin 



1 • NO KM AL CXI T ( t iac t 



•-CLAT SKIN 



t» CmCRGCnCY CH T 



C-OSCILLATING SKr 



S'NOMAL CXIT ( Through canopy) 



0* ROLL ING 



C • r um • L inC 



P'OlSINTIGKATION 



COCKPI T/CA0IN CONOITION AFTER IMPACT 



G* INVC K TC 0 



0*N0 0 KMAGC (Othar than canopy loaa. ate.) 



H- MUSH INC 



••MINO* 0 *mAGC (Definitely habitable) 



I -STKKIGhT a no LC VCL 



2 • K( A SONAOL Y INTACT (Probably habitable) 



2 -unknown 



3 -majOR OAMAGC (Probably net habitable) 



4-OCSTKOYCO (Definitely not habitable) 



••unknown 



I2« EJECTION SEA T/P ARACWUTC TRAINING (Mat required for paaaengera aha had no opportunity to eecape.) 



TVKf or tkaining 


TOTAL MRS. IN TNG 


o a t c or last tng 


R0LC 1 


<LC*»C •L*"K» 


LCCTUACS/ 










UN A KMC 0 CJCCTION 
SCAT 










apmco SCAT 
On rovtt 










training rtLMS 










PARASAt L 

TRAINING 


i *WK 










»• 1 1 • 










JUMK SCHOOL 










OTHCR ( Spaa 1 f y) 










N KMC or 1 NOl V 1 OU AL 



X Vaa the fallowing coder fa 
aha w rata training played 



O-NO IMKOKTAnCC 

(•TRAINING OCKINITCLT «UP(0 

2* tkaininc KOSSIKLT hCI K CO 

1 • L AC K or TKKiNtNG OC r I N I T f l T 
A KACTOK 

4*LACA or tkaining *055 
A » AC TOK 

♦ • UN« NOWN 



126 



VII. 



EJECTION OR BAILOUT (Compht* for oil inflight eacmpea mnd * ject iont ) 



I. TIME r ROM ONSET NTIL ESCAPE ATTEMPT **S initiated 



«0 POSITION O r EJECTION SEAT AT TIME OF EJECTION 



l*»uu UP 



2 -PULL 00 *N 



OElAY IN INITIATING ESCAPE OUE T Q 



f M T C »Mf 01 *tr POS I T I ON 



>-UN*/nQT «>»UC*»LI 



t . ifTtM^riNC 
TO OVC*CO*C 
PA08LCM 



GAINING 
AL T I TUOC 



I . oKl* m 



1 ■ a vO I O I NG 
•OPUt * Tto 
A * t A 



LOSI NG 
A l T 1 TuOC 



3 **010115 

un sui table 

TC ABA I N 



METHOD of SEPARATING man F POA SEAT 



0-010 not 
s CP aba TC 



1‘PUSnCO 

SCir A • A V 



•SCAT 
s CP a* A To* 



••CASOnnCL 

P abachu TC 



2* SPON TANCOUS 
Tumbl I NC 



TERRAIN CLEARANCE at time OF 



* -UNANOAN 



E5C*M ( Fft)~ 



a a B a C hu T C OP tN I n G 
< F**t ) 



• I *SPCCO at f I uf 0» 
CSCAPC 

X I AS 



i 2 



TYPE of seat SEPARATOR 



i • ti aooch 
T 



rar er 



PROTECT I VE MELME t 

CHIN s T b A A 

* AS tcncc 



HELMET VISOR L 0* E R E 0 



l-A APACHUTC 



a- SNgSA I n G 



-SCAT 3 

■ , 



ME r HOOS OF DEPLOYING PapachuTE 



O-NON OCPLOVCO 



I • AU TO** Tic TIMC* 



•ero»c cmc*g. 



2* anC*0I 0 



1-«*LL I STIC OCviCC 



OUAING £ G*C S S 



A-ZC*0 LANVAbo 



S- STat |C LINC 



Ou A 1 nG ChuTC 

lanoinc 



(-manually 



CHIN JTAap FASTCNCO 
SNUCLY 



NAPC STAAP CASTCNCO 

SNUCLT 



* -UNAnOon 



parachute opening SHOCK 



l , - T0 l 



*-UM» 



l-YCS 



O-nCGL l 61 BLC 



ZERO LAN Y A RO 



* - UNA NO*N 



*N C N CONNCCTCO 



0- AVAI LA#LC/nOT 
CONNCCTCO 



IS. parachute 
oscillations 



* P A I O A TO CMCAGCNCT 



A. OUAING OCSCCNT 



> *NCG’ 
ICIILE 



1 - MOO- 
C AA TC 



2-PAIOA TO CSCAPC 
OUAING CMCAGCNCY 



)-TIM( UNKNOWN 



OuAtsG L ano I NG 



PARACHUTE DAMAGE (Gi** number) 



• •na/not availablc 



* 'UNBNOON 



S C VC AC 0 $H*0U0 LINCS 



SUAVIVAL *■ *C t 0 a 



MiiSUg Mn C IS 



T O *N f ANILS, M A JO A 



fo ■ N Panels. minO* 



O-nOT a PACTOA 
SgAVI val 



I * P AC TO A IN SUAVIVAL 



2 • NO T A PACT0A in 
nonsuav 1 val 



JTACTOA IN NONSUAVIVAL 



CAUSE OF PARACHUTE OAMAGE 



1-OPCninG SmOCa 



2-cjcction scat 



AUTOMATIC LAP BELT RELEASE 



• r OUL C 0 ON Af*CAAPT 
•0 Ti*E» ( £>*•<: r • ) 



•010 NOT 
OPCN OA 
ACLC *SC 



1 - ACLCASCO 
AUTO. AS 
OCSIGNCO 



2*0PCNC0 
MANU ALL V 



» • UN* NQNN/ NONC 



3-OPCNCO 
| N AO VC A- 

tcntly 



7 -NOT 
CON- 
NCC TCO 



B -UN* 

NO* 

ACLCASCO 



* -UN* NO»N 

i p *c- 
LC ASCO 



I S ■ FOUR LINE RELEASE T-VCS 



ATTCMP TCO 



B-PAHTLV s-unb 



removal of AIRCRAFT canopy 



SUCCCCOCO 



STOPPCO OSC ILLA TiONS 



1 • INTCN T . 



2 • U N f N T C N T . 



I S *UN*NO*N 



SLO*CO OCSCCNT 



INI Tl ATCO 8 Y 



PAOVIOCO STCCA1NG 



l-TNI s 

INOIVI OUAL 



2- ANOTMC a 
I NO i vt OUAL 



* -0 TmC a/ 

UN * NO BN 



DIRECTION OF ORIFT/OSCILLATION 
FACEO AT CHUTE LANOING 



0-OCP. NOT ATT CM* T f 0 



I • ACCONPL I SMCO 



1 -01 ACC TL V 
P ACING 



J * Ou * A T C A I NR 
r acing 



2-attcwatcoI 1/niuccnB., 



S-UN* tt attcmptco 



mCTnOO OP initiating ACmOval 



A • OU AATCBfNG 
8 *C * 



S*Oi acctlv 

S I OCAAyS 



I * ABN *CST/LCC • a AC C 



2 - p ac C Cuatain 



L AMO ING CONO 1 T I ONS 



a-manuallv UNLOC«CO 



S*C«TC*nal POACC 



I-OTm(* f OMCf ib») 



total *t unoca pa* ac mu t c a. su*p»cc *no 

( Lb, . ) 



OAACGCO 8 v Cnu»C 



| I * v C S 



0. OISTANCC OAAGGCO ( r*rd,) 



parachute LANDING POSITION techniques 



1 


1 • 1 N re N T 1 ON*L | 


n 


| 2 -UNIN TCn t. j 


n 


S • UN* NO ON 






O-COULO not set 




1 -LOO* HG *mC *0 


a. 




INI Tl ATCO 














2 * LOO* 1 NG bn 




S-Q TnCA/ uNBNO«N 




1 • Tmi S 

1 NO 1 VlOuAL 




2* ANO T»f « 

i NO 1 V t OUAL 




* -o TmT m 
UN* NOON 


a 




* • P CLL 0#l 1 OUCL ▼ 




2 ■ r f LL 8ACAOAB0 




3 * r C l L PO*oA«0 




v-qtmCO/unrnOon 


c. 






Ml T MOO 














1 - muSCLCS TfnSCO 




2 • m»j S C L C S TOO T C N 5 C 




I* ABM Bisf 'iff. «•*<-{ 




2 * < Arc Cu»f« IN 






J • Too Bf 1. 4 | f n 




* • 0 Tm| * / UN* NOON 




1*0 * 1 N>. 




A - *1 


at si out in 


0 




»•*•''»(* * n ^ i f t on 




?*#NiT s t oc«co 




A • 1 M* AC P 




4* f 


• «r 










11 *!>'’* Ai'SlT. 




* • (1 Tm| B ■ l, N a NOON 




T*V( • 


All* •» S 




*•0 


’Hi * 


1 1 *t »m '0*1 t 


2? 


CFPlL'YfO LANDING 


1*11 


1 > 


0 - NO 


* -U«*A 




* ' UN* **''#•» 














* S* 


■*»l v*l *1 1 








* 


«UOY "OS i T 1 ^ 


>% at 


r i e c t i » >n 






» l 


Iff • * • f 










(A, c >•■+ 9 .% t * <4 


t n t h « ./»!(• 


i / fiM If l«> 


1 * 




C 1 


p » i > i -■ r 












“* *o 


r ■ 


- p ; 


x: 


* t i r 


f’ BO«S 


1 T 




f" A*. 1’ V r 1 1 L A T l ON P 




: T G 





-4- 



L L 



.*1* N<* • N 



* i S » i • * s » n f. 



I •** > 11 . fH f» 



* > . ■ • li i r» 



j * * N« N. I <•> 
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USAF MISHAP REPORT 

(Fill in all spaces applicable. If additional apace is needed, use additional sheel(s).) 



t. oatc o" occuMN(NCi(0«r, 

Month and Ysmr) 



J. vEMtCLlfl) 0« MATFflilL iHVOuveo 

designation and serial no. It applicable) 



1. row SKOUNO acciointi only 

(Boss Coda and Report Sarlal No.) 



a. place o a occunhincc. state, county, outamci »no oibiction from 

NEAREST TO**N, tv ON BA|(. IOINTIFY. IF BA}( lllVl OtlTANd V AO M 

NlABflT (Alt. 



( 1 OA Y NtGN T 

[ } O A MM ( ) Qu»* 



ORGANIZATION POSSESSING OR OWNING VEHICLE OR MATERIEL AT TIME OF MISHAP 



AJOR command IubcowO OR a v air oivision 



SO OR UNI T N AM C * tAIC COO E 



(Llet organ! tat tone a I eacond rahlcla, ll Ihay dlllar Inm hem 7 above) 



%. ORGANIZATION and sasc SUBMITTING REPORT (Do not sbbesatmts) 



LIST OF PERSONNEL OIRECTLY INVOLVED 
(Saa APR 127-2 tor epeclllc instructions) 



LAST name, FIRST name. MtOOLC INITIAL graoe 



OCGRCC 

INJURY * 

ft Ism Abbe) 



OA YS LOS T 
ON 

TT ONLY 



f (Bntot spptlcabls Isttar(s) In DEORB E INJURY column. YonoWV/ Temporary T otat^TT; Permanent Partisl-PP; Psrmansnt TotahPT; 
Pstal^Pi Mlsslnfdd) 



, FACTUAL summary OF Cl « CUMS T am C e S. GIVE a OtTilLGO HISTORY OF FLIGHT 0« CHRONOLOGICAL OROtR OF FACTS Am O 
CIRCUMSTANCES LEAOING to TNE MISHAP. the RESULTS of INVESTIGATION RILL 8E CONTAinEO TN ThI " ANALYSIS PART- 
OF TNE REPORT. ANALYSIS OF * M O CONCLUSIONS ORAIn FROM ORAL OR RRiTTEn STATEMENTS OGTAinEO ONLY IN TnE 

interest of mishar prevention rill not m€ incluoco in tnis summary. 



1J. 




authentication 




Certification Gy (Tills) 


TvRCO name Ah O GRAOC 




OA TB 
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APPENDIX D 



SAMPLE FORMAT OF SYSTEM SAFETY HAZARD ANALYSIS 



SYSTEM 

SUBSYSTEM 

COMPONENT 



HAZARD/ 

LNDESIKED 

EVENT 


PHASE 


CAUSE 


EFFECT 


CLASSI- 

FICATION 


CORRECTIVE 
ACTTON/MINI- 
MIZIN3 PRO- 
VISIONS 


Descriptive 
short title 


Program 
phase in 
which the 
hazard may 
occur, e.g., 
ground 
operation , 
take off, 
climb, 
in flight, 
return 
to base, 
landing 


Events which 

create 

hazard 


Description 
of the 
effects of 
the hazard 
on both 
personnel 
and equip- 
ment 


Haza 

whid 

pend 

the 

effec 

Fir si 

is d 

fica 1 

of h< 

with( 

any < 

rect 

actic 

minir 

prov: 

The : 

col. 

cl as: 

catic 

afte: 

rect 

actic 

been 


rd 

h de- 
3 on 

St. 

t col. 
Lassi- 
tion 
azard 
sut 
sor- 
Lve 
m or 
nizing 
Lsicns . 
seccnd 
is the 
sifi- 
Dn 

c oor- 
Lve 

xi has 
taken. 


Description of 
action taken to 
eliminate or 
minimize and 
control the 
hazard . All 
safety design 
requirements, 
safety proce- 
dures, proba- 
bilities of 
occurrence , 
safety devices 
used, and any 
other signifi- 
cant action 
taken to mini- 
mize and con- 
trol the 
hazards should 
be included in 
this column. 
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APPENDIX E 



SAMPLE TREND CHART 



) USflF H 010 



m 



RUTO TF :, EMD CHART 

P 



i ilJC = 1 3 H '< >: 



MRP SO - FEB 8 1 



7 

A 



/TlAirO 4 /iaj P/ /Qfi. 



R 

fl 

T 

E 

P 

E 

R 

1 

0 

0 

o 

0 

0 

F 

H 

R 

S 



RF [ 50 ' 
(09FEES 



EP 

1 i 



36 — 
92 — 
29 — 
24 — 
20 ■ 

15 
12 -- 
9 — 
4 — 



MRP 



RPR 


r iB v 


JUM 


JUL 


RUG 


SEP 


OCT 


MOV 


DEC 


JAM 



FEB 



A — • A — 

'■ 7 \ 




CLFT35 fl 8/C 



RATE 



21,5 16. £ 18. 1 9 7 17 2 3.5 3 .4 7.3 10 



20 3 



22 4 



RATE 



TREND — — — — 



T I&ZS / LO>-K-&¥~-S 



FLYING HOOPS FOR 


THIS OUTPUT 






9259 


10759 


11036 


11533 


11607 


11754 


1 1890 


13665 


10023 


9725 


1 1 137. 7 


3088. 57 



SLOPE * .342048443357 INTERCEPT • 13.6S2S3757 

CORRELATION COEFFICIENT * . 1 39394294025 

90 V. CONFIDENCE INT FOR SLOPE »- 1 . 3b'?324SS635 TO 2 . 05402 1 5530E 
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